EMAll.cpp@ 41823

Last change on this file since 41823 was 41823, checked in by vboxsync, 13 years ago
Avoid using SELMValidateAndConvertCSAddr+EMInterpretDisasOneEx when possible and call EMInterpretDisasOne instead. Changed EMInterpretDisasOne to use SELMValidateAndConvertCSAddr instead of SELMToFlatEx.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 114.4 KB

Line
1	/* $Id: EMAll.cpp 41823 2012-06-19 13:43:39Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2012 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/*******************************************************************************
19	* Header Files *
20	*******************************************************************************/
21	#define LOG_GROUP LOG_GROUP_EM
22	#include <VBox/vmm/em.h>
23	#include <VBox/vmm/mm.h>
24	#include <VBox/vmm/selm.h>
25	#include <VBox/vmm/patm.h>
26	#include <VBox/vmm/csam.h>
27	#include <VBox/vmm/pgm.h>
28	#ifdef VBOX_WITH_IEM
29	# include <VBox/vmm/iem.h>
30	#endif
31	#include <VBox/vmm/iom.h>
32	#include <VBox/vmm/stam.h>
33	#include "EMInternal.h"
34	#include <VBox/vmm/vm.h>
35	#include <VBox/vmm/vmm.h>
36	#include <VBox/vmm/hwaccm.h>
37	#include <VBox/vmm/tm.h>
38	#include <VBox/vmm/pdmapi.h>
39	#include <VBox/param.h>
40	#include <VBox/err.h>
41	#include <VBox/dis.h>
42	#include <VBox/disopcode.h>
43	#include <VBox/log.h>
44	#include "internal/pgm.h"
45	#include <iprt/assert.h>
46	#include <iprt/asm.h>
47	#include <iprt/string.h>
48
49
50	/*******************************************************************************
51	* Defined Constants And Macros *
52	*******************************************************************************/
53	/** @def EM_ASSERT_FAULT_RETURN
54	* Safety check.
55	*
56	* Could in theory misfire on a cross page boundary access...
57	*
58	* Currently disabled because the CSAM (+ PATM) patch monitoring occasionally
59	* turns up an alias page instead of the original faulting one and annoying the
60	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
61	*/
62	#if 0
63	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
64	#else
65	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
66	#endif
67
68
69	/*******************************************************************************
70	* Internal Functions *
71	*******************************************************************************/
72	#ifndef VBOX_WITH_IEM
73	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPUOuter(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
74	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize);
75	#endif
76
77
78
79	/**
80	* Get the current execution manager status.
81	*
82	* @returns Current status.
83	* @param pVCpu Pointer to the VMCPU.
84	*/
85	VMMDECL(EMSTATE) EMGetState(PVMCPU pVCpu)
86	{
87	return pVCpu->em.s.enmState;
88	}
89
90	/**
91	* Sets the current execution manager status. (use only when you know what you're doing!)
92	*
93	* @param pVCpu Pointer to the VMCPU.
94	*/
95	VMMDECL(void) EMSetState(PVMCPU pVCpu, EMSTATE enmNewState)
96	{
97	/* Only allowed combination: */
98	Assert(pVCpu->em.s.enmState == EMSTATE_WAIT_SIPI && enmNewState == EMSTATE_HALTED);
99	pVCpu->em.s.enmState = enmNewState;
100	}
101
102
103	/**
104	* Sets the PC for which interrupts should be inhibited.
105	*
106	* @param pVCpu Pointer to the VMCPU.
107	* @param PC The PC.
108	*/
109	VMMDECL(void) EMSetInhibitInterruptsPC(PVMCPU pVCpu, RTGCUINTPTR PC)
110	{
111	pVCpu->em.s.GCPtrInhibitInterrupts = PC;
112	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
113	}
114
115
116	/**
117	* Gets the PC for which interrupts should be inhibited.
118	*
119	* There are a few instructions which inhibits or delays interrupts
120	* for the instruction following them. These instructions are:
121	* - STI
122	* - MOV SS, r/m16
123	* - POP SS
124	*
125	* @returns The PC for which interrupts should be inhibited.
126	* @param pVCpu Pointer to the VMCPU.
127	*
128	*/
129	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVMCPU pVCpu)
130	{
131	return pVCpu->em.s.GCPtrInhibitInterrupts;
132	}
133
134
135	/**
136	* Prepare an MWAIT - essentials of the MONITOR instruction.
137	*
138	* @returns VINF_SUCCESS
139	* @param pVCpu The current CPU.
140	* @param rax The content of RAX.
141	* @param rcx The content of RCX.
142	* @param rdx The content of RDX.
143	*/
144	VMM_INT_DECL(int) EMMonitorWaitPrepare(PVMCPU pVCpu, uint64_t rax, uint64_t rcx, uint64_t rdx)
145	{
146	pVCpu->em.s.MWait.uMonitorRAX = rax;
147	pVCpu->em.s.MWait.uMonitorRCX = rcx;
148	pVCpu->em.s.MWait.uMonitorRDX = rdx;
149	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_MONITOR_ACTIVE;
150	/** @todo Complete MONITOR implementation. */
151	return VINF_SUCCESS;
152	}
153
154
155	/**
156	* Performs an MWAIT.
157	*
158	* @returns VINF_SUCCESS
159	* @param pVCpu The current CPU.
160	* @param rax The content of RAX.
161	* @param rcx The content of RCX.
162	*/
163	VMM_INT_DECL(int) EMMonitorWaitPerform(PVMCPU pVCpu, uint64_t rax, uint64_t rcx)
164	{
165	pVCpu->em.s.MWait.uMWaitRAX = rax;
166	pVCpu->em.s.MWait.uMWaitRCX = rcx;
167	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_ACTIVE;
168	if (rcx)
169	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_BREAKIRQIF0;
170	else
171	pVCpu->em.s.MWait.fWait &= ~EMMWAIT_FLAG_BREAKIRQIF0;
172	/** @todo not completely correct?? */
173	return VINF_EM_HALT;
174	}
175
176
177
178	/**
179	* Determine if we should continue after encountering a hlt or mwait
180	* instruction.
181	*
182	* Clears MWAIT flags if returning @c true.
183	*
184	* @returns boolean
185	* @param pVCpu Pointer to the VMCPU.
186	* @param pCtx Current CPU context.
187	*/
188	VMM_INT_DECL(bool) EMShouldContinueAfterHalt(PVMCPU pVCpu, PCPUMCTX pCtx)
189	{
190	if ( pCtx->eflags.Bits.u1IF
191	\|\| ( (pVCpu->em.s.MWait.fWait & (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0))
192	== (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0)) )
193	{
194	pVCpu->em.s.MWait.fWait &= ~(EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0);
195	return !!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC));
196	}
197
198	return false;
199	}
200
201
202	/**
203	* Locks REM execution to a single VCpu
204	*
205	* @param pVM Pointer to the VM.
206	*/
207	VMMDECL(void) EMRemLock(PVM pVM)
208	{
209	#ifdef VBOX_WITH_REM
210	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
211	return; /* early init */
212
213	Assert(!PGMIsLockOwner(pVM));
214	Assert(!IOMIsLockOwner(pVM));
215	int rc = PDMCritSectEnter(&pVM->em.s.CritSectREM, VERR_SEM_BUSY);
216	AssertRCSuccess(rc);
217	#endif
218	}
219
220
221	/**
222	* Unlocks REM execution
223	*
224	* @param pVM Pointer to the VM.
225	*/
226	VMMDECL(void) EMRemUnlock(PVM pVM)
227	{
228	#ifdef VBOX_WITH_REM
229	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
230	return; /* early init */
231
232	PDMCritSectLeave(&pVM->em.s.CritSectREM);
233	#endif
234	}
235
236
237	/**
238	* Check if this VCPU currently owns the REM lock.
239	*
240	* @returns bool owner/not owner
241	* @param pVM Pointer to the VM.
242	*/
243	VMMDECL(bool) EMRemIsLockOwner(PVM pVM)
244	{
245	#ifdef VBOX_WITH_REM
246	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
247	return true; /* early init */
248
249	return PDMCritSectIsOwner(&pVM->em.s.CritSectREM);
250	#else
251	return true;
252	#endif
253	}
254
255
256	/**
257	* Try to acquire the REM lock.
258	*
259	* @returns VBox status code
260	* @param pVM Pointer to the VM.
261	*/
262	VMMDECL(int) EMRemTryLock(PVM pVM)
263	{
264	#ifdef VBOX_WITH_REM
265	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
266	return VINF_SUCCESS; /* early init */
267
268	return PDMCritSectTryEnter(&pVM->em.s.CritSectREM);
269	#else
270	return VINF_SUCCESS;
271	#endif
272	}
273
274
275	/**
276	* @callback_method_impl{FNDISREADBYTES}
277	*/
278	static DECLCALLBACK(int) emReadBytes(PDISCPUSTATE pDis, uint8_t offInstr, uint8_t cbMinRead, uint8_t cbMaxRead)
279	{
280	PVMCPU pVCpu = (PVMCPU)pDis->pvUser;
281	#if defined(IN_RC) \|\| defined(IN_RING3)
282	PVM pVM = pVCpu->CTX_SUFF(pVM);
283	#endif
284	RTUINTPTR uSrcAddr = pDis->uInstrAddr + offInstr;
285	int rc;
286
287	/*
288	* Figure how much we can or must read.
289	*/
290	size_t cbToRead = PAGE_SIZE - (uSrcAddr & PAGE_OFFSET_MASK);
291	if (cbToRead > cbMaxRead)
292	cbToRead = cbMaxRead;
293	else if (cbToRead < cbMinRead)
294	cbToRead = cbMinRead;
295
296	#if defined(IN_RC) \|\| defined(IN_RING3)
297	/*
298	* We might be called upon to interpret an instruction in a patch.
299	*/
300	if (PATMIsPatchGCAddr(pVCpu->CTX_SUFF(pVM), uSrcAddr))
301	{
302	# ifdef IN_RC
303	memcpy(&pDis->abInstr[offInstr], (void *)(uintptr_t)uSrcAddr, cbToRead);
304	# else
305	memcpy(&pDis->abInstr[offInstr], PATMR3GCPtrToHCPtr(pVCpu->CTX_SUFF(pVM), uSrcAddr), cbToRead);
306	# endif
307	rc = VINF_SUCCESS;
308	}
309	else
310	#endif
311	{
312	# ifdef IN_RC
313	/*
314	* Try access it thru the shadow page tables first. Fall back on the
315	* slower PGM method if it fails because the TLB or page table was
316	* modified recently.
317	*/
318	rc = MMGCRamRead(pVCpu->pVMRC, &pDis->abInstr[offInstr], (void *)(uintptr_t)uSrcAddr, cbToRead);
319	if (rc == VERR_ACCESS_DENIED && cbToRead > cbMinRead)
320	{
321	cbToRead = cbMinRead;
322	rc = MMGCRamRead(pVCpu->pVMRC, &pDis->abInstr[offInstr], (void *)(uintptr_t)uSrcAddr, cbToRead);
323	}
324	if (rc == VERR_ACCESS_DENIED)
325	#endif
326	{
327	rc = PGMPhysSimpleReadGCPtr(pVCpu, &pDis->abInstr[offInstr], uSrcAddr, cbToRead);
328	if (RT_FAILURE(rc))
329	{
330	if (cbToRead > cbMinRead)
331	{
332	cbToRead = cbMinRead;
333	rc = PGMPhysSimpleReadGCPtr(pVCpu, &pDis->abInstr[offInstr], uSrcAddr, cbToRead);
334	}
335	if (RT_FAILURE(rc))
336	{
337	#ifndef IN_RC
338	/*
339	* If we fail to find the page via the guest's page tables
340	* we invalidate the page in the host TLB (pertaining to
341	* the guest in the NestedPaging case). See @bugref{6043}.
342	*/
343	if (rc == VERR_PAGE_TABLE_NOT_PRESENT \|\| rc == VERR_PAGE_NOT_PRESENT)
344	{
345	HWACCMInvalidatePage(pVCpu, uSrcAddr);
346	if (((uSrcAddr + cbToRead - 1) >> PAGE_SHIFT) != (uSrcAddr >> PAGE_SHIFT))
347	HWACCMInvalidatePage(pVCpu, uSrcAddr + cbToRead - 1);
348	}
349	#endif
350	}
351	}
352	}
353	}
354
355	pDis->cbCachedInstr = offInstr + (uint8_t)cbToRead;
356	return rc;
357	}
358
359
360	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
361	{
362	return DISInstrWithReader(InstrGC, (DISCPUMODE)pDis->uCpuMode, emReadBytes, pVCpu, pDis, pOpsize);
363	}
364
365
366	/**
367	* Disassembles one instruction.
368	*
369	* @returns VBox status code, see SELMToFlatEx and EMInterpretDisasOneEx for
370	* details.
371	* @retval VERR_EM_INTERNAL_DISAS_ERROR on DISCoreOneEx failure.
372	*
373	* @param pVM Pointer to the VM.
374	* @param pVCpu Pointer to the VMCPU.
375	* @param pCtxCore The context core (used for both the mode and instruction).
376	* @param pDis Where to return the parsed instruction info.
377	* @param pcbInstr Where to return the instruction size. (optional)
378	*/
379	VMMDECL(int) EMInterpretDisasOne(PVM pVM, PVMCPU pVCpu, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
380	{
381	RTGCPTR GCPtrInstr;
382	#if 0
383	int rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
384	#else
385	/** @todo Get the CPU mode as well while we're at it! */
386	int rc = SELMValidateAndConvertCSAddr(pVCpu, pCtxCore->eflags, pCtxCore->ss, pCtxCore->cs,
387	&pCtxCore->csHid, pCtxCore->rip, &GCPtrInstr);
388	#endif
389	if (RT_FAILURE(rc))
390	{
391	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RGv (cpl=%d) - rc=%Rrc !!\n",
392	pCtxCore->cs, (RTGCPTR)pCtxCore->rip, pCtxCore->ss & X86_SEL_RPL, rc));
393	return rc;
394	}
395	return EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pDis, pcbInstr);
396	}
397
398
399	/**
400	* Disassembles one instruction.
401	*
402	* This is used by internally by the interpreter and by trap/access handlers.
403	*
404	* @returns VBox status code.
405	* @retval VERR_EM_INTERNAL_DISAS_ERROR on DISCoreOneEx failure.
406	*
407	* @param pVM Pointer to the VM.
408	* @param pVCpu Pointer to the VMCPU.
409	* @param GCPtrInstr The flat address of the instruction.
410	* @param pCtxCore The context core (used to determine the cpu mode).
411	* @param pDis Where to return the parsed instruction info.
412	* @param pcbInstr Where to return the instruction size. (optional)
413	*/
414	VMMDECL(int) EMInterpretDisasOneEx(PVM pVM, PVMCPU pVCpu, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore,
415	PDISCPUSTATE pDis, unsigned *pcbInstr)
416	{
417	DISCPUMODE enmCpuMode = SELMGetCpuModeFromSelector(pVCpu, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid);
418	/** @todo Deal with too long instruction (=> \#GP), opcode read errors (=>
419	* \#PF, \#GP, \#??), undefined opcodes (=> \#UD), and such. */
420	int rc = DISInstrWithReader(GCPtrInstr, enmCpuMode, emReadBytes, pVCpu, pDis, pcbInstr);
421	if (RT_SUCCESS(rc))
422	return VINF_SUCCESS;
423	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%RGv rc=%Rrc\n", GCPtrInstr, rc));
424	return VERR_EM_INTERNAL_DISAS_ERROR;
425	}
426
427
428	/**
429	* Interprets the current instruction.
430	*
431	* @returns VBox status code.
432	* @retval VINF_* Scheduling instructions.
433	* @retval VERR_EM_INTERPRETER Something we can't cope with.
434	* @retval VERR_* Fatal errors.
435	*
436	* @param pVCpu Pointer to the VMCPU.
437	* @param pRegFrame The register frame.
438	* Updates the EIP if an instruction was executed successfully.
439	* @param pvFault The fault address (CR2).
440	* @param pcbSize Size of the write (if applicable).
441	*
442	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
443	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
444	* to worry about e.g. invalid modrm combinations (!)
445	*/
446	VMMDECL(VBOXSTRICTRC) EMInterpretInstruction(PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault)
447	{
448	LogFlow(("EMInterpretInstruction %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
449	#ifdef VBOX_WITH_IEM
450	NOREF(pvFault);
451	VBOXSTRICTRC rc = IEMExecOneEx(pVCpu, pRegFrame, NULL);
452	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
453	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
454	return VERR_EM_INTERPRETER;
455	return rc;
456	#else
457	RTGCPTR pbCode;
458	VBOXSTRICTRC rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
459	if (RT_SUCCESS(rc))
460	{
461	uint32_t cbOp;
462	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
463	pDis->uCpuMode = SELMGetCpuModeFromSelector(pVCpu, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
464	rc = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
465	if (RT_SUCCESS(rc))
466	{
467	Assert(cbOp == pDis->cbInstr);
468	uint32_t cbIgnored;
469	rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, &cbIgnored);
470	if (RT_SUCCESS(rc))
471	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
472
473	return rc;
474	}
475	}
476	return VERR_EM_INTERPRETER;
477	#endif
478	}
479
480
481	/**
482	* Interprets the current instruction.
483	*
484	* @returns VBox status code.
485	* @retval VINF_* Scheduling instructions.
486	* @retval VERR_EM_INTERPRETER Something we can't cope with.
487	* @retval VERR_* Fatal errors.
488	*
489	* @param pVM Pointer to the VM.
490	* @param pVCpu Pointer to the VMCPU.
491	* @param pRegFrame The register frame.
492	* Updates the EIP if an instruction was executed successfully.
493	* @param pvFault The fault address (CR2).
494	* @param pcbWritten Size of the write (if applicable).
495	*
496	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
497	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
498	* to worry about e.g. invalid modrm combinations (!)
499	*/
500	VMMDECL(VBOXSTRICTRC) EMInterpretInstructionEx(PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbWritten)
501	{
502	LogFlow(("EMInterpretInstructionEx %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
503	#ifdef VBOX_WITH_IEM
504	NOREF(pvFault);
505	VBOXSTRICTRC rc = IEMExecOneEx(pVCpu, pRegFrame, pcbWritten);
506	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
507	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
508	return VERR_EM_INTERPRETER;
509	return rc;
510	#else
511	RTGCPTR pbCode;
512	VBOXSTRICTRC rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
513	if (RT_SUCCESS(rc))
514	{
515	uint32_t cbOp;
516	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
517	pDis->uCpuMode = SELMGetCpuModeFromSelector(pVCpu, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
518	rc = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
519	if (RT_SUCCESS(rc))
520	{
521	Assert(cbOp == pDis->cbInstr);
522	rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, pcbWritten);
523	if (RT_SUCCESS(rc))
524	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
525
526	return rc;
527	}
528	}
529	return VERR_EM_INTERPRETER;
530	#endif
531	}
532
533
534	/**
535	* Interprets the current instruction using the supplied DISCPUSTATE structure.
536	*
537	* IP/EIP/RIP IS updated!
538	*
539	* @returns VBox strict status code.
540	* @retval VINF_* Scheduling instructions. When these are returned, it
541	* starts to get a bit tricky to know whether code was
542	* executed or not... We'll address this when it becomes a problem.
543	* @retval VERR_EM_INTERPRETER Something we can't cope with.
544	* @retval VERR_* Fatal errors.
545	*
546	* @param pVM Pointer to the VM.
547	* @param pVCpu Pointer to the VMCPU.
548	* @param pDis The disassembler cpu state for the instruction to be
549	* interpreted.
550	* @param pRegFrame The register frame. IP/EIP/RIP IS changed!
551	* @param pvFault The fault address (CR2).
552	* @param pcbSize Size of the write (if applicable).
553	* @param enmCodeType Code type (user/supervisor)
554	*
555	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
556	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
557	* to worry about e.g. invalid modrm combinations (!)
558	*
559	* @todo At this time we do NOT check if the instruction overwrites vital information.
560	* Make sure this can't happen!! (will add some assertions/checks later)
561	*/
562	VMMDECL(VBOXSTRICTRC) EMInterpretInstructionDisasState(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
563	RTGCPTR pvFault, EMCODETYPE enmCodeType)
564	{
565	LogFlow(("EMInterpretInstructionDisasState %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
566	#ifdef VBOX_WITH_IEM
567	NOREF(pDis); NOREF(pvFault); NOREF(enmCodeType);
568	VBOXSTRICTRC rc = IEMExecOneWithPrefetchedByPC(pVCpu, pRegFrame, pRegFrame->rip, pDis->abInstr, pDis->cbCachedInstr);
569	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
570	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
571	return VERR_EM_INTERPRETER;
572	return rc;
573	#else
574	uint32_t cbIgnored;
575	VBOXSTRICTRC rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, enmCodeType, &cbIgnored);
576	if (RT_SUCCESS(rc))
577	pRegFrame->rip += pDis->cbInstr; /* Move on to the next instruction. */
578	return rc;
579	#endif
580	}
581
582	#if defined(IN_RC) /&& defined(VBOX_WITH_PATM)/
583
584	DECLINLINE(int) emRCStackRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
585	{
586	int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
587	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
588	return rc;
589	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
590	}
591
592
593	/**
594	* Interpret IRET (currently only to V86 code) - PATM only.
595	*
596	* @returns VBox status code.
597	* @param pVM Pointer to the VM.
598	* @param pVCpu Pointer to the VMCPU.
599	* @param pRegFrame The register frame.
600	*
601	*/
602	VMMDECL(int) EMInterpretIretV86ForPatm(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
603	{
604	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
605	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
606	int rc;
607
608	Assert(!CPUMIsGuestIn64BitCode(pVCpu, pRegFrame));
609	/** @todo Rainy day: Test what happens when VERR_EM_INTERPRETER is returned by
610	* this function. Fear that it may guru on us, thus not converted to
611	* IEM. */
612
613	rc = emRCStackRead(pVM, pVCpu, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
614	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
615	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
616	AssertRCReturn(rc, VERR_EM_INTERPRETER);
617	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
618
619	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
620	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
621	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &es, (RTGCPTR)(pIretStack + 20), 4);
622	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &ds, (RTGCPTR)(pIretStack + 24), 4);
623	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &fs, (RTGCPTR)(pIretStack + 28), 4);
624	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &gs, (RTGCPTR)(pIretStack + 32), 4);
625	AssertRCReturn(rc, VERR_EM_INTERPRETER);
626
627	pRegFrame->eip = eip & 0xffff;
628	pRegFrame->cs = cs;
629
630	/* Mask away all reserved bits */
631	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
632	eflags &= uMask;
633
634	CPUMRawSetEFlags(pVCpu, pRegFrame, eflags);
635	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
636
637	pRegFrame->esp = esp;
638	pRegFrame->ss = ss;
639	pRegFrame->ds = ds;
640	pRegFrame->es = es;
641	pRegFrame->fs = fs;
642	pRegFrame->gs = gs;
643
644	return VINF_SUCCESS;
645	}
646
647	#endif /* IN_RC && VBOX_WITH_PATM */
648	#ifndef VBOX_WITH_IEM
649
650
651
652
653
654
655	/*
656	*
657	* The old interpreter.
658	* The old interpreter.
659	* The old interpreter.
660	* The old interpreter.
661	* The old interpreter.
662	*
663	*/
664
665	DECLINLINE(int) emRamRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
666	{
667	#ifdef IN_RC
668	int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
669	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
670	return rc;
671	/*
672	* The page pool cache may end up here in some cases because it
673	* flushed one of the shadow mappings used by the trapping
674	* instruction and it either flushed the TLB or the CPU reused it.
675	*/
676	#else
677	NOREF(pVM);
678	#endif
679	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
680	}
681
682
683	DECLINLINE(int) emRamWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, uint32_t cb)
684	{
685	/* Don't use MMGCRamWrite here as it does not respect zero pages, shared
686	pages or write monitored pages. */
687	NOREF(pVM);
688	return PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, /fMayTrap/ false);
689	}
690
691
692	/** Convert sel:addr to a flat GC address. */
693	DECLINLINE(RTGCPTR) emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, PDISOPPARAM pParam, RTGCPTR pvAddr)
694	{
695	DISSELREG enmPrefixSeg = DISDetectSegReg(pDis, pParam);
696	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
697	}
698
699
700	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
701	/**
702	* Get the mnemonic for the disassembled instruction.
703	*
704	* GC/R0 doesn't include the strings in the DIS tables because
705	* of limited space.
706	*/
707	static const char *emGetMnemonic(PDISCPUSTATE pDis)
708	{
709	switch (pDis->pCurInstr->uOpcode)
710	{
711	case OP_XCHG: return "Xchg";
712	case OP_DEC: return "Dec";
713	case OP_INC: return "Inc";
714	case OP_POP: return "Pop";
715	case OP_OR: return "Or";
716	case OP_AND: return "And";
717	case OP_MOV: return "Mov";
718	case OP_INVLPG: return "InvlPg";
719	case OP_CPUID: return "CpuId";
720	case OP_MOV_CR: return "MovCRx";
721	case OP_MOV_DR: return "MovDRx";
722	case OP_LLDT: return "LLdt";
723	case OP_LGDT: return "LGdt";
724	case OP_LIDT: return "LIdt";
725	case OP_CLTS: return "Clts";
726	case OP_MONITOR: return "Monitor";
727	case OP_MWAIT: return "MWait";
728	case OP_RDMSR: return "Rdmsr";
729	case OP_WRMSR: return "Wrmsr";
730	case OP_ADD: return "Add";
731	case OP_ADC: return "Adc";
732	case OP_SUB: return "Sub";
733	case OP_SBB: return "Sbb";
734	case OP_RDTSC: return "Rdtsc";
735	case OP_STI: return "Sti";
736	case OP_CLI: return "Cli";
737	case OP_XADD: return "XAdd";
738	case OP_HLT: return "Hlt";
739	case OP_IRET: return "Iret";
740	case OP_MOVNTPS: return "MovNTPS";
741	case OP_STOSWD: return "StosWD";
742	case OP_WBINVD: return "WbInvd";
743	case OP_XOR: return "Xor";
744	case OP_BTR: return "Btr";
745	case OP_BTS: return "Bts";
746	case OP_BTC: return "Btc";
747	case OP_LMSW: return "Lmsw";
748	case OP_SMSW: return "Smsw";
749	case OP_CMPXCHG: return pDis->fPrefix & DISPREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
750	case OP_CMPXCHG8B: return pDis->fPrefix & DISPREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
751
752	default:
753	Log(("Unknown opcode %d\n", pDis->pCurInstr->uOpcode));
754	return "???";
755	}
756	}
757	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
758
759
760	/**
761	* XCHG instruction emulation.
762	*/
763	static int emInterpretXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
764	{
765	DISQPVPARAMVAL param1, param2;
766	NOREF(pvFault);
767
768	/* Source to make DISQueryParamVal read the register value - ugly hack */
769	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
770	if(RT_FAILURE(rc))
771	return VERR_EM_INTERPRETER;
772
773	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
774	if(RT_FAILURE(rc))
775	return VERR_EM_INTERPRETER;
776
777	#ifdef IN_RC
778	if (TRPMHasTrap(pVCpu))
779	{
780	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
781	{
782	#endif
783	RTGCPTR pParam1 = 0, pParam2 = 0;
784	uint64_t valpar1, valpar2;
785
786	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
787	switch(param1.type)
788	{
789	case DISQPV_TYPE_IMMEDIATE: /* register type is translated to this one too */
790	valpar1 = param1.val.val64;
791	break;
792
793	case DISQPV_TYPE_ADDRESS:
794	pParam1 = (RTGCPTR)param1.val.val64;
795	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
796	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
797	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
798	if (RT_FAILURE(rc))
799	{
800	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
801	return VERR_EM_INTERPRETER;
802	}
803	break;
804
805	default:
806	AssertFailed();
807	return VERR_EM_INTERPRETER;
808	}
809
810	switch(param2.type)
811	{
812	case DISQPV_TYPE_ADDRESS:
813	pParam2 = (RTGCPTR)param2.val.val64;
814	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param2, pParam2);
815	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
816	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar2, pParam2, param2.size);
817	if (RT_FAILURE(rc))
818	{
819	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
820	}
821	break;
822
823	case DISQPV_TYPE_IMMEDIATE:
824	valpar2 = param2.val.val64;
825	break;
826
827	default:
828	AssertFailed();
829	return VERR_EM_INTERPRETER;
830	}
831
832	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
833	if (pParam1 == 0)
834	{
835	Assert(param1.type == DISQPV_TYPE_IMMEDIATE); /* register actually */
836	switch(param1.size)
837	{
838	case 1: //special case for AH etc
839	rc = DISWriteReg8(pRegFrame, pDis->Param1.Base.idxGenReg, (uint8_t )valpar2); break;
840	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, (uint16_t)valpar2); break;
841	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param1.Base.idxGenReg, (uint32_t)valpar2); break;
842	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param1.Base.idxGenReg, valpar2); break;
843	default: AssertFailedReturn(VERR_EM_INTERPRETER);
844	}
845	if (RT_FAILURE(rc))
846	return VERR_EM_INTERPRETER;
847	}
848	else
849	{
850	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar2, param1.size);
851	if (RT_FAILURE(rc))
852	{
853	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
854	return VERR_EM_INTERPRETER;
855	}
856	}
857
858	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
859	if (pParam2 == 0)
860	{
861	Assert(param2.type == DISQPV_TYPE_IMMEDIATE); /* register actually */
862	switch(param2.size)
863	{
864	case 1: //special case for AH etc
865	rc = DISWriteReg8(pRegFrame, pDis->Param2.Base.idxGenReg, (uint8_t )valpar1); break;
866	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param2.Base.idxGenReg, (uint16_t)valpar1); break;
867	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param2.Base.idxGenReg, (uint32_t)valpar1); break;
868	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param2.Base.idxGenReg, valpar1); break;
869	default: AssertFailedReturn(VERR_EM_INTERPRETER);
870	}
871	if (RT_FAILURE(rc))
872	return VERR_EM_INTERPRETER;
873	}
874	else
875	{
876	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam2, &valpar1, param2.size);
877	if (RT_FAILURE(rc))
878	{
879	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
880	return VERR_EM_INTERPRETER;
881	}
882	}
883
884	*pcbSize = param2.size;
885	return VINF_SUCCESS;
886	#ifdef IN_RC
887	}
888	}
889	return VERR_EM_INTERPRETER;
890	#endif
891	}
892
893
894	/**
895	* INC and DEC emulation.
896	*/
897	static int emInterpretIncDec(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
898	PFNEMULATEPARAM2 pfnEmulate)
899	{
900	DISQPVPARAMVAL param1;
901	NOREF(pvFault);
902
903	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
904	if(RT_FAILURE(rc))
905	return VERR_EM_INTERPRETER;
906
907	#ifdef IN_RC
908	if (TRPMHasTrap(pVCpu))
909	{
910	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
911	{
912	#endif
913	RTGCPTR pParam1 = 0;
914	uint64_t valpar1;
915
916	if (param1.type == DISQPV_TYPE_ADDRESS)
917	{
918	pParam1 = (RTGCPTR)param1.val.val64;
919	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
920	#ifdef IN_RC
921	/* Safety check (in theory it could cross a page boundary and fault there though) */
922	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
923	#endif
924	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
925	if (RT_FAILURE(rc))
926	{
927	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
928	return VERR_EM_INTERPRETER;
929	}
930	}
931	else
932	{
933	AssertFailed();
934	return VERR_EM_INTERPRETER;
935	}
936
937	uint32_t eflags;
938
939	eflags = pfnEmulate(&valpar1, param1.size);
940
941	/* Write result back */
942	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
943	if (RT_FAILURE(rc))
944	{
945	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
946	return VERR_EM_INTERPRETER;
947	}
948
949	/* Update guest's eflags and finish. */
950	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
951	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
952
953	/* All done! */
954	*pcbSize = param1.size;
955	return VINF_SUCCESS;
956	#ifdef IN_RC
957	}
958	}
959	return VERR_EM_INTERPRETER;
960	#endif
961	}
962
963
964	/**
965	* POP Emulation.
966	*/
967	static int emInterpretPop(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
968	{
969	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
970	DISQPVPARAMVAL param1;
971	NOREF(pvFault);
972
973	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
974	if(RT_FAILURE(rc))
975	return VERR_EM_INTERPRETER;
976
977	#ifdef IN_RC
978	if (TRPMHasTrap(pVCpu))
979	{
980	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
981	{
982	#endif
983	RTGCPTR pParam1 = 0;
984	uint32_t valpar1;
985	RTGCPTR pStackVal;
986
987	/* Read stack value first */
988	if (SELMGetCpuModeFromSelector(pVCpu, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == DISCPUMODE_16BIT)
989	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
990
991	/* Convert address; don't bother checking limits etc, as we only read here */
992	pStackVal = SELMToFlat(pVM, DISSELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
993	if (pStackVal == 0)
994	return VERR_EM_INTERPRETER;
995
996	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pStackVal, param1.size);
997	if (RT_FAILURE(rc))
998	{
999	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1000	return VERR_EM_INTERPRETER;
1001	}
1002
1003	if (param1.type == DISQPV_TYPE_ADDRESS)
1004	{
1005	pParam1 = (RTGCPTR)param1.val.val64;
1006
1007	/* pop [esp+xx] uses esp after the actual pop! */
1008	AssertCompile(DISGREG_ESP == DISGREG_SP);
1009	if ( (pDis->Param1.fUse & DISUSE_BASE)
1010	&& (pDis->Param1.fUse & (DISUSE_REG_GEN16\|DISUSE_REG_GEN32))
1011	&& pDis->Param1.Base.idxGenReg == DISGREG_ESP
1012	)
1013	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
1014
1015	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1016	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
1017	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1018	if (RT_FAILURE(rc))
1019	{
1020	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1021	return VERR_EM_INTERPRETER;
1022	}
1023
1024	/* Update ESP as the last step */
1025	pRegFrame->esp += param1.size;
1026	}
1027	else
1028	{
1029	#ifndef DEBUG_bird // annoying assertion.
1030	AssertFailed();
1031	#endif
1032	return VERR_EM_INTERPRETER;
1033	}
1034
1035	/* All done! */
1036	*pcbSize = param1.size;
1037	return VINF_SUCCESS;
1038	#ifdef IN_RC
1039	}
1040	}
1041	return VERR_EM_INTERPRETER;
1042	#endif
1043	}
1044
1045
1046	/**
1047	* XOR/OR/AND Emulation.
1048	*/
1049	static int emInterpretOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1050	PFNEMULATEPARAM3 pfnEmulate)
1051	{
1052	DISQPVPARAMVAL param1, param2;
1053	NOREF(pvFault);
1054
1055	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1056	if(RT_FAILURE(rc))
1057	return VERR_EM_INTERPRETER;
1058
1059	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1060	if(RT_FAILURE(rc))
1061	return VERR_EM_INTERPRETER;
1062
1063	#ifdef IN_RC
1064	if (TRPMHasTrap(pVCpu))
1065	{
1066	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1067	{
1068	#endif
1069	RTGCPTR pParam1;
1070	uint64_t valpar1, valpar2;
1071
1072	if (pDis->Param1.cb != pDis->Param2.cb)
1073	{
1074	if (pDis->Param1.cb < pDis->Param2.cb)
1075	{
1076	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb)); /* should never happen! */
1077	return VERR_EM_INTERPRETER;
1078	}
1079	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
1080	pDis->Param2.cb = pDis->Param1.cb;
1081	param2.size = param1.size;
1082	}
1083
1084	/* The destination is always a virtual address */
1085	if (param1.type == DISQPV_TYPE_ADDRESS)
1086	{
1087	pParam1 = (RTGCPTR)param1.val.val64;
1088	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1089	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
1090	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
1091	if (RT_FAILURE(rc))
1092	{
1093	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1094	return VERR_EM_INTERPRETER;
1095	}
1096	}
1097	else
1098	{
1099	AssertFailed();
1100	return VERR_EM_INTERPRETER;
1101	}
1102
1103	/* Register or immediate data */
1104	switch(param2.type)
1105	{
1106	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1107	valpar2 = param2.val.val64;
1108	break;
1109
1110	default:
1111	AssertFailed();
1112	return VERR_EM_INTERPRETER;
1113	}
1114
1115	LogFlow(("emInterpretOrXorAnd %s %RGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pDis), pParam1, valpar1, valpar2, param2.size, param1.size));
1116
1117	/* Data read, emulate instruction. */
1118	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
1119
1120	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pDis), valpar1));
1121
1122	/* Update guest's eflags and finish. */
1123	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1124	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1125
1126	/* And write it back */
1127	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1128	if (RT_SUCCESS(rc))
1129	{
1130	/* All done! */
1131	*pcbSize = param2.size;
1132	return VINF_SUCCESS;
1133	}
1134	#ifdef IN_RC
1135	}
1136	}
1137	#endif
1138	return VERR_EM_INTERPRETER;
1139	}
1140
1141
1142	/**
1143	* LOCK XOR/OR/AND Emulation.
1144	*/
1145	static int emInterpretLockOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1146	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
1147	{
1148	void *pvParam1;
1149	DISQPVPARAMVAL param1, param2;
1150	NOREF(pvFault);
1151
1152	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
1153	Assert(pDis->Param1.cb <= 4);
1154	#endif
1155
1156	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1157	if(RT_FAILURE(rc))
1158	return VERR_EM_INTERPRETER;
1159
1160	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1161	if(RT_FAILURE(rc))
1162	return VERR_EM_INTERPRETER;
1163
1164	if (pDis->Param1.cb != pDis->Param2.cb)
1165	{
1166	AssertMsgReturn(pDis->Param1.cb >= pDis->Param2.cb, /* should never happen! */
1167	("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb),
1168	VERR_EM_INTERPRETER);
1169
1170	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
1171	pDis->Param2.cb = pDis->Param1.cb;
1172	param2.size = param1.size;
1173	}
1174
1175	#ifdef IN_RC
1176	/* Safety check (in theory it could cross a page boundary and fault there though) */
1177	Assert( TRPMHasTrap(pVCpu)
1178	&& (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW));
1179	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
1180	#endif
1181
1182	/* Register and immediate data == DISQPV_TYPE_IMMEDIATE */
1183	AssertReturn(param2.type == DISQPV_TYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1184	RTGCUINTREG ValPar2 = param2.val.val64;
1185
1186	/* The destination is always a virtual address */
1187	AssertReturn(param1.type == DISQPV_TYPE_ADDRESS, VERR_EM_INTERPRETER);
1188
1189	RTGCPTR GCPtrPar1 = param1.val.val64;
1190	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
1191	PGMPAGEMAPLOCK Lock;
1192	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1193	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1194
1195	/* Try emulate it with a one-shot #PF handler in place. (RC) */
1196	Log2(("%s %RGv imm%d=%RX64\n", emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
1197
1198	RTGCUINTREG32 eflags = 0;
1199	rc = pfnEmulate(pvParam1, ValPar2, pDis->Param2.cb, &eflags);
1200	PGMPhysReleasePageMappingLock(pVM, &Lock);
1201	if (RT_FAILURE(rc))
1202	{
1203	Log(("%s %RGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
1204	return VERR_EM_INTERPRETER;
1205	}
1206
1207	/* Update guest's eflags and finish. */
1208	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1209	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1210
1211	*pcbSize = param2.size;
1212	return VINF_SUCCESS;
1213	}
1214
1215
1216	/**
1217	* ADD, ADC & SUB Emulation.
1218	*/
1219	static int emInterpretAddSub(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1220	PFNEMULATEPARAM3 pfnEmulate)
1221	{
1222	NOREF(pvFault);
1223	DISQPVPARAMVAL param1, param2;
1224	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1225	if(RT_FAILURE(rc))
1226	return VERR_EM_INTERPRETER;
1227
1228	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1229	if(RT_FAILURE(rc))
1230	return VERR_EM_INTERPRETER;
1231
1232	#ifdef IN_RC
1233	if (TRPMHasTrap(pVCpu))
1234	{
1235	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1236	{
1237	#endif
1238	RTGCPTR pParam1;
1239	uint64_t valpar1, valpar2;
1240
1241	if (pDis->Param1.cb != pDis->Param2.cb)
1242	{
1243	if (pDis->Param1.cb < pDis->Param2.cb)
1244	{
1245	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb)); /* should never happen! */
1246	return VERR_EM_INTERPRETER;
1247	}
1248	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
1249	pDis->Param2.cb = pDis->Param1.cb;
1250	param2.size = param1.size;
1251	}
1252
1253	/* The destination is always a virtual address */
1254	if (param1.type == DISQPV_TYPE_ADDRESS)
1255	{
1256	pParam1 = (RTGCPTR)param1.val.val64;
1257	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1258	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
1259	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
1260	if (RT_FAILURE(rc))
1261	{
1262	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1263	return VERR_EM_INTERPRETER;
1264	}
1265	}
1266	else
1267	{
1268	#ifndef DEBUG_bird
1269	AssertFailed();
1270	#endif
1271	return VERR_EM_INTERPRETER;
1272	}
1273
1274	/* Register or immediate data */
1275	switch(param2.type)
1276	{
1277	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1278	valpar2 = param2.val.val64;
1279	break;
1280
1281	default:
1282	AssertFailed();
1283	return VERR_EM_INTERPRETER;
1284	}
1285
1286	/* Data read, emulate instruction. */
1287	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
1288
1289	/* Update guest's eflags and finish. */
1290	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1291	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1292
1293	/* And write it back */
1294	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1295	if (RT_SUCCESS(rc))
1296	{
1297	/* All done! */
1298	*pcbSize = param2.size;
1299	return VINF_SUCCESS;
1300	}
1301	#ifdef IN_RC
1302	}
1303	}
1304	#endif
1305	return VERR_EM_INTERPRETER;
1306	}
1307
1308
1309	/**
1310	* ADC Emulation.
1311	*/
1312	static int emInterpretAdc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1313	{
1314	if (pRegFrame->eflags.Bits.u1CF)
1315	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
1316	else
1317	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
1318	}
1319
1320
1321	/**
1322	* BTR/C/S Emulation.
1323	*/
1324	static int emInterpretBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1325	PFNEMULATEPARAM2UINT32 pfnEmulate)
1326	{
1327	DISQPVPARAMVAL param1, param2;
1328	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1329	if(RT_FAILURE(rc))
1330	return VERR_EM_INTERPRETER;
1331
1332	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1333	if(RT_FAILURE(rc))
1334	return VERR_EM_INTERPRETER;
1335
1336	#ifdef IN_RC
1337	if (TRPMHasTrap(pVCpu))
1338	{
1339	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1340	{
1341	#endif
1342	RTGCPTR pParam1;
1343	uint64_t valpar1 = 0, valpar2;
1344	uint32_t eflags;
1345
1346	/* The destination is always a virtual address */
1347	if (param1.type != DISQPV_TYPE_ADDRESS)
1348	return VERR_EM_INTERPRETER;
1349
1350	pParam1 = (RTGCPTR)param1.val.val64;
1351	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1352
1353	/* Register or immediate data */
1354	switch(param2.type)
1355	{
1356	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1357	valpar2 = param2.val.val64;
1358	break;
1359
1360	default:
1361	AssertFailed();
1362	return VERR_EM_INTERPRETER;
1363	}
1364
1365	Log2(("emInterpret%s: pvFault=%RGv pParam1=%RGv val2=%x\n", emGetMnemonic(pDis), pvFault, pParam1, valpar2));
1366	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1367	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
1368	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, 1);
1369	if (RT_FAILURE(rc))
1370	{
1371	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1372	return VERR_EM_INTERPRETER;
1373	}
1374
1375	Log2(("emInterpretBtx: val=%x\n", valpar1));
1376	/* Data read, emulate bit test instruction. */
1377	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1378
1379	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1380
1381	/* Update guest's eflags and finish. */
1382	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1383	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1384
1385	/* And write it back */
1386	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, 1);
1387	if (RT_SUCCESS(rc))
1388	{
1389	/* All done! */
1390	*pcbSize = 1;
1391	return VINF_SUCCESS;
1392	}
1393	#ifdef IN_RC
1394	}
1395	}
1396	#endif
1397	return VERR_EM_INTERPRETER;
1398	}
1399
1400
1401	/**
1402	* LOCK BTR/C/S Emulation.
1403	*/
1404	static int emInterpretLockBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1405	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1406	{
1407	void *pvParam1;
1408
1409	DISQPVPARAMVAL param1, param2;
1410	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1411	if(RT_FAILURE(rc))
1412	return VERR_EM_INTERPRETER;
1413
1414	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1415	if(RT_FAILURE(rc))
1416	return VERR_EM_INTERPRETER;
1417
1418	/* The destination is always a virtual address */
1419	if (param1.type != DISQPV_TYPE_ADDRESS)
1420	return VERR_EM_INTERPRETER;
1421
1422	/* Register and immediate data == DISQPV_TYPE_IMMEDIATE */
1423	AssertReturn(param2.type == DISQPV_TYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1424	uint64_t ValPar2 = param2.val.val64;
1425
1426	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1427	RTGCPTR GCPtrPar1 = param1.val.val64;
1428	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
1429	ValPar2 &= 7;
1430
1431	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
1432	#ifdef IN_RC
1433	Assert(TRPMHasTrap(pVCpu));
1434	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
1435	#endif
1436
1437	PGMPAGEMAPLOCK Lock;
1438	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1439	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1440
1441	Log2(("emInterpretLockBitTest %s: pvFault=%RGv GCPtrPar1=%RGv imm=%RX64\n", emGetMnemonic(pDis), pvFault, GCPtrPar1, ValPar2));
1442
1443	/* Try emulate it with a one-shot #PF handler in place. (RC) */
1444	RTGCUINTREG32 eflags = 0;
1445	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
1446	PGMPhysReleasePageMappingLock(pVM, &Lock);
1447	if (RT_FAILURE(rc))
1448	{
1449	Log(("emInterpretLockBitTest %s: %RGv imm%d=%RX64 -> emulation failed due to page fault!\n",
1450	emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
1451	return VERR_EM_INTERPRETER;
1452	}
1453
1454	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RX64 CF=%d\n", emGetMnemonic(pDis), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1455
1456	/* Update guest's eflags and finish. */
1457	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1458	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1459
1460	*pcbSize = 1;
1461	return VINF_SUCCESS;
1462	}
1463
1464
1465	/**
1466	* MOV emulation.
1467	*/
1468	static int emInterpretMov(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1469	{
1470	NOREF(pvFault);
1471	DISQPVPARAMVAL param1, param2;
1472	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1473	if(RT_FAILURE(rc))
1474	return VERR_EM_INTERPRETER;
1475
1476	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1477	if(RT_FAILURE(rc))
1478	return VERR_EM_INTERPRETER;
1479
1480	#ifdef IN_RC
1481	if (TRPMHasTrap(pVCpu))
1482	{
1483	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1484	{
1485	#else
1486	/** @todo Make this the default and don't rely on TRPM information. */
1487	if (param1.type == DISQPV_TYPE_ADDRESS)
1488	{
1489	#endif
1490	RTGCPTR pDest;
1491	uint64_t val64;
1492
1493	switch(param1.type)
1494	{
1495	case DISQPV_TYPE_IMMEDIATE:
1496	if(!(param1.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
1497	return VERR_EM_INTERPRETER;
1498	/* fallthru */
1499
1500	case DISQPV_TYPE_ADDRESS:
1501	pDest = (RTGCPTR)param1.val.val64;
1502	pDest = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pDest);
1503	break;
1504
1505	default:
1506	AssertFailed();
1507	return VERR_EM_INTERPRETER;
1508	}
1509
1510	switch(param2.type)
1511	{
1512	case DISQPV_TYPE_IMMEDIATE: /* register type is translated to this one too */
1513	val64 = param2.val.val64;
1514	break;
1515
1516	default:
1517	Log(("emInterpretMov: unexpected type=%d rip=%RGv\n", param2.type, (RTGCPTR)pRegFrame->rip));
1518	return VERR_EM_INTERPRETER;
1519	}
1520	#ifdef LOG_ENABLED
1521	if (pDis->uCpuMode == DISCPUMODE_64BIT)
1522	LogFlow(("EMInterpretInstruction at %RGv: OP_MOV %RGv <- %RX64 (%d) &val64=%RHv\n", (RTGCPTR)pRegFrame->rip, pDest, val64, param2.size, &val64));
1523	else
1524	LogFlow(("EMInterpretInstruction at %08RX64: OP_MOV %RGv <- %08X (%d) &val64=%RHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
1525	#endif
1526
1527	Assert(param2.size <= 8 && param2.size > 0);
1528	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
1529	rc = emRamWrite(pVM, pVCpu, pRegFrame, pDest, &val64, param2.size);
1530	if (RT_FAILURE(rc))
1531	return VERR_EM_INTERPRETER;
1532
1533	*pcbSize = param2.size;
1534	}
1535	else
1536	{ /* read fault */
1537	RTGCPTR pSrc;
1538	uint64_t val64;
1539
1540	/* Source */
1541	switch(param2.type)
1542	{
1543	case DISQPV_TYPE_IMMEDIATE:
1544	if(!(param2.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
1545	return VERR_EM_INTERPRETER;
1546	/* fallthru */
1547
1548	case DISQPV_TYPE_ADDRESS:
1549	pSrc = (RTGCPTR)param2.val.val64;
1550	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param2, pSrc);
1551	break;
1552
1553	default:
1554	return VERR_EM_INTERPRETER;
1555	}
1556
1557	Assert(param1.size <= 8 && param1.size > 0);
1558	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
1559	rc = emRamRead(pVM, pVCpu, pRegFrame, &val64, pSrc, param1.size);
1560	if (RT_FAILURE(rc))
1561	return VERR_EM_INTERPRETER;
1562
1563	/* Destination */
1564	switch(param1.type)
1565	{
1566	case DISQPV_TYPE_REGISTER:
1567	switch(param1.size)
1568	{
1569	case 1: rc = DISWriteReg8(pRegFrame, pDis->Param1.Base.idxGenReg, (uint8_t) val64); break;
1570	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, (uint16_t)val64); break;
1571	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param1.Base.idxGenReg, (uint32_t)val64); break;
1572	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param1.Base.idxGenReg, val64); break;
1573	default:
1574	return VERR_EM_INTERPRETER;
1575	}
1576	if (RT_FAILURE(rc))
1577	return rc;
1578	break;
1579
1580	default:
1581	return VERR_EM_INTERPRETER;
1582	}
1583	#ifdef LOG_ENABLED
1584	if (pDis->uCpuMode == DISCPUMODE_64BIT)
1585	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
1586	else
1587	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
1588	#endif
1589	}
1590	return VINF_SUCCESS;
1591	#ifdef IN_RC
1592	}
1593	return VERR_EM_INTERPRETER;
1594	#endif
1595	}
1596
1597
1598	#ifndef IN_RC
1599	/**
1600	* [REP] STOSWD emulation
1601	*/
1602	static int emInterpretStosWD(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1603	{
1604	int rc;
1605	RTGCPTR GCDest, GCOffset;
1606	uint32_t cbSize;
1607	uint64_t cTransfers;
1608	int offIncrement;
1609	NOREF(pvFault);
1610
1611	/* Don't support any but these three prefix bytes. */
1612	if ((pDis->fPrefix & ~(DISPREFIX_ADDRSIZE\|DISPREFIX_OPSIZE\|DISPREFIX_REP\|DISPREFIX_REX)))
1613	return VERR_EM_INTERPRETER;
1614
1615	switch (pDis->uAddrMode)
1616	{
1617	case DISCPUMODE_16BIT:
1618	GCOffset = pRegFrame->di;
1619	cTransfers = pRegFrame->cx;
1620	break;
1621	case DISCPUMODE_32BIT:
1622	GCOffset = pRegFrame->edi;
1623	cTransfers = pRegFrame->ecx;
1624	break;
1625	case DISCPUMODE_64BIT:
1626	GCOffset = pRegFrame->rdi;
1627	cTransfers = pRegFrame->rcx;
1628	break;
1629	default:
1630	AssertFailed();
1631	return VERR_EM_INTERPRETER;
1632	}
1633
1634	GCDest = SELMToFlat(pVM, DISSELREG_ES, pRegFrame, GCOffset);
1635	switch (pDis->uOpMode)
1636	{
1637	case DISCPUMODE_16BIT:
1638	cbSize = 2;
1639	break;
1640	case DISCPUMODE_32BIT:
1641	cbSize = 4;
1642	break;
1643	case DISCPUMODE_64BIT:
1644	cbSize = 8;
1645	break;
1646	default:
1647	AssertFailed();
1648	return VERR_EM_INTERPRETER;
1649	}
1650
1651	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
1652
1653	if (!(pDis->fPrefix & DISPREFIX_REP))
1654	{
1655	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize));
1656
1657	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1658	if (RT_FAILURE(rc))
1659	return VERR_EM_INTERPRETER;
1660	Assert(rc == VINF_SUCCESS);
1661
1662	/* Update (e/r)di. */
1663	switch (pDis->uAddrMode)
1664	{
1665	case DISCPUMODE_16BIT:
1666	pRegFrame->di += offIncrement;
1667	break;
1668	case DISCPUMODE_32BIT:
1669	pRegFrame->edi += offIncrement;
1670	break;
1671	case DISCPUMODE_64BIT:
1672	pRegFrame->rdi += offIncrement;
1673	break;
1674	default:
1675	AssertFailed();
1676	return VERR_EM_INTERPRETER;
1677	}
1678
1679	}
1680	else
1681	{
1682	if (!cTransfers)
1683	return VINF_SUCCESS;
1684
1685	/*
1686	* Do not try emulate cross page stuff here because we don't know what might
1687	* be waiting for us on the subsequent pages. The caller has only asked us to
1688	* ignore access handlers fro the current page.
1689	* This also fends off big stores which would quickly kill PGMR0DynMap.
1690	*/
1691	if ( cbSize > PAGE_SIZE
1692	\|\| cTransfers > PAGE_SIZE
1693	\|\| (GCDest >> PAGE_SHIFT) != ((GCDest + offIncrement * cTransfers) >> PAGE_SHIFT))
1694	{
1695	Log(("STOSWD is crosses pages, chicken out to the recompiler; GCDest=%RGv cbSize=%#x offIncrement=%d cTransfers=%#x\n",
1696	GCDest, cbSize, offIncrement, cTransfers));
1697	return VERR_EM_INTERPRETER;
1698	}
1699
1700	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
1701	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1702	rc = PGMVerifyAccess(pVCpu, GCDest - ((offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize)),
1703	cTransfers * cbSize,
1704	X86_PTE_RW \| (CPUMGetGuestCPL(pVCpu, pRegFrame) == 3 ? X86_PTE_US : 0));
1705	if (rc != VINF_SUCCESS)
1706	{
1707	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
1708	return VERR_EM_INTERPRETER;
1709	}
1710
1711	/* REP case */
1712	while (cTransfers)
1713	{
1714	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1715	if (RT_FAILURE(rc))
1716	{
1717	rc = VERR_EM_INTERPRETER;
1718	break;
1719	}
1720
1721	Assert(rc == VINF_SUCCESS);
1722	GCOffset += offIncrement;
1723	GCDest += offIncrement;
1724	cTransfers--;
1725	}
1726
1727	/* Update the registers. */
1728	switch (pDis->uAddrMode)
1729	{
1730	case DISCPUMODE_16BIT:
1731	pRegFrame->di = GCOffset;
1732	pRegFrame->cx = cTransfers;
1733	break;
1734	case DISCPUMODE_32BIT:
1735	pRegFrame->edi = GCOffset;
1736	pRegFrame->ecx = cTransfers;
1737	break;
1738	case DISCPUMODE_64BIT:
1739	pRegFrame->rdi = GCOffset;
1740	pRegFrame->rcx = cTransfers;
1741	break;
1742	default:
1743	AssertFailed();
1744	return VERR_EM_INTERPRETER;
1745	}
1746	}
1747
1748	*pcbSize = cbSize;
1749	return rc;
1750	}
1751	#endif /* !IN_RC */
1752
1753
1754	/**
1755	* [LOCK] CMPXCHG emulation.
1756	*/
1757	static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1758	{
1759	DISQPVPARAMVAL param1, param2;
1760	NOREF(pvFault);
1761
1762	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
1763	Assert(pDis->Param1.cb <= 4);
1764	#endif
1765
1766	/* Source to make DISQueryParamVal read the register value - ugly hack */
1767	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
1768	if(RT_FAILURE(rc))
1769	return VERR_EM_INTERPRETER;
1770
1771	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1772	if(RT_FAILURE(rc))
1773	return VERR_EM_INTERPRETER;
1774
1775	uint64_t valpar;
1776	switch(param2.type)
1777	{
1778	case DISQPV_TYPE_IMMEDIATE: /* register actually */
1779	valpar = param2.val.val64;
1780	break;
1781
1782	default:
1783	return VERR_EM_INTERPRETER;
1784	}
1785
1786	PGMPAGEMAPLOCK Lock;
1787	RTGCPTR GCPtrPar1;
1788	void *pvParam1;
1789	uint64_t eflags;
1790
1791	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
1792	switch(param1.type)
1793	{
1794	case DISQPV_TYPE_ADDRESS:
1795	GCPtrPar1 = param1.val.val64;
1796	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
1797
1798	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1799	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1800	break;
1801
1802	default:
1803	return VERR_EM_INTERPRETER;
1804	}
1805
1806	LogFlow(("%s %RGv rax=%RX64 %RX64\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar));
1807
1808	if (pDis->fPrefix & DISPREFIX_LOCK)
1809	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->Param2.cb);
1810	else
1811	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->Param2.cb);
1812
1813	LogFlow(("%s %RGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
1814
1815	/* Update guest's eflags and finish. */
1816	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1817	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1818
1819	*pcbSize = param2.size;
1820	PGMPhysReleasePageMappingLock(pVM, &Lock);
1821	return VINF_SUCCESS;
1822	}
1823
1824
1825	/**
1826	* [LOCK] CMPXCHG8B emulation.
1827	*/
1828	static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1829	{
1830	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
1831	DISQPVPARAMVAL param1;
1832	NOREF(pvFault);
1833
1834	/* Source to make DISQueryParamVal read the register value - ugly hack */
1835	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
1836	if(RT_FAILURE(rc))
1837	return VERR_EM_INTERPRETER;
1838
1839	RTGCPTR GCPtrPar1;
1840	void *pvParam1;
1841	uint64_t eflags;
1842	PGMPAGEMAPLOCK Lock;
1843
1844	AssertReturn(pDis->Param1.cb == 8, VERR_EM_INTERPRETER);
1845	switch(param1.type)
1846	{
1847	case DISQPV_TYPE_ADDRESS:
1848	GCPtrPar1 = param1.val.val64;
1849	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
1850
1851	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1852	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1853	break;
1854
1855	default:
1856	return VERR_EM_INTERPRETER;
1857	}
1858
1859	LogFlow(("%s %RGv=%08x eax=%08x\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax));
1860
1861	if (pDis->fPrefix & DISPREFIX_LOCK)
1862	eflags = EMEmulateLockCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1863	else
1864	eflags = EMEmulateCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1865
1866	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1867
1868	/* Update guest's eflags and finish; note that only ZF is affected. */
1869	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1870	\| (eflags & (X86_EFL_ZF));
1871
1872	*pcbSize = 8;
1873	PGMPhysReleasePageMappingLock(pVM, &Lock);
1874	return VINF_SUCCESS;
1875	}
1876
1877
1878	#ifdef IN_RC /** @todo test+enable for HWACCM as well. */
1879	/**
1880	* [LOCK] XADD emulation.
1881	*/
1882	static int emInterpretXAdd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1883	{
1884	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
1885	DISQPVPARAMVAL param1;
1886	void *pvParamReg2;
1887	size_t cbParamReg2;
1888	NOREF(pvFault);
1889
1890	/* Source to make DISQueryParamVal read the register value - ugly hack */
1891	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
1892	if(RT_FAILURE(rc))
1893	return VERR_EM_INTERPRETER;
1894
1895	rc = DISQueryParamRegPtr(pRegFrame, pDis, &pDis->Param2, &pvParamReg2, &cbParamReg2);
1896	Assert(cbParamReg2 <= 4);
1897	if(RT_FAILURE(rc))
1898	return VERR_EM_INTERPRETER;
1899
1900	#ifdef IN_RC
1901	if (TRPMHasTrap(pVCpu))
1902	{
1903	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1904	{
1905	#endif
1906	RTGCPTR GCPtrPar1;
1907	void *pvParam1;
1908	uint32_t eflags;
1909	PGMPAGEMAPLOCK Lock;
1910
1911	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
1912	switch(param1.type)
1913	{
1914	case DISQPV_TYPE_ADDRESS:
1915	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, (RTRCUINTPTR)param1.val.val64);
1916	#ifdef IN_RC
1917	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
1918	#endif
1919
1920	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1921	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1922	break;
1923
1924	default:
1925	return VERR_EM_INTERPRETER;
1926	}
1927
1928	LogFlow(("XAdd %RGv=%p reg=%08llx\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2));
1929
1930	if (pDis->fPrefix & DISPREFIX_LOCK)
1931	eflags = EMEmulateLockXAdd(pvParam1, pvParamReg2, cbParamReg2);
1932	else
1933	eflags = EMEmulateXAdd(pvParam1, pvParamReg2, cbParamReg2);
1934
1935	LogFlow(("XAdd %RGv=%p reg=%08llx ZF=%d\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2, !!(eflags & X86_EFL_ZF) ));
1936
1937	/* Update guest's eflags and finish. */
1938	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1939	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1940
1941	*pcbSize = cbParamReg2;
1942	PGMPhysReleasePageMappingLock(pVM, &Lock);
1943	return VINF_SUCCESS;
1944	#ifdef IN_RC
1945	}
1946	}
1947
1948	return VERR_EM_INTERPRETER;
1949	#endif
1950	}
1951	#endif /* IN_RC */
1952
1953
1954	/**
1955	* IRET Emulation.
1956	*/
1957	static int emInterpretIret(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1958	{
1959	/* only allow direct calls to EMInterpretIret for now */
1960	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
1961	return VERR_EM_INTERPRETER;
1962	}
1963
1964	/**
1965	* WBINVD Emulation.
1966	*/
1967	static int emInterpretWbInvd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1968	{
1969	/* Nothing to do. */
1970	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
1971	return VINF_SUCCESS;
1972	}
1973
1974
1975	/**
1976	* Interpret INVLPG
1977	*
1978	* @returns VBox status code.
1979	* @param pVM Pointer to the VM.
1980	* @param pVCpu Pointer to the VMCPU.
1981	* @param pRegFrame The register frame.
1982	* @param pAddrGC Operand address
1983	*
1984	*/
1985	VMMDECL(VBOXSTRICTRC) EMInterpretInvlpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1986	{
1987	/** @todo is addr always a flat linear address or ds based
1988	* (in absence of segment override prefixes)????
1989	*/
1990	NOREF(pVM); NOREF(pRegFrame);
1991	#ifdef IN_RC
1992	LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
1993	#endif
1994	VBOXSTRICTRC rc = PGMInvalidatePage(pVCpu, pAddrGC);
1995	if ( rc == VINF_SUCCESS
1996	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1997	return VINF_SUCCESS;
1998	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1999	("%Rrc addr=%RGv\n", VBOXSTRICTRC_VAL(rc), pAddrGC),
2000	VERR_EM_INTERPRETER);
2001	return rc;
2002	}
2003
2004
2005	/**
2006	* INVLPG Emulation.
2007	*/
2008	static VBOXSTRICTRC emInterpretInvlPg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2009	{
2010	DISQPVPARAMVAL param1;
2011	RTGCPTR addr;
2012	NOREF(pvFault); NOREF(pVM); NOREF(pcbSize);
2013
2014	VBOXSTRICTRC rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2015	if(RT_FAILURE(rc))
2016	return VERR_EM_INTERPRETER;
2017
2018	switch(param1.type)
2019	{
2020	case DISQPV_TYPE_IMMEDIATE:
2021	case DISQPV_TYPE_ADDRESS:
2022	if(!(param1.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
2023	return VERR_EM_INTERPRETER;
2024	addr = (RTGCPTR)param1.val.val64;
2025	break;
2026
2027	default:
2028	return VERR_EM_INTERPRETER;
2029	}
2030
2031	/** @todo is addr always a flat linear address or ds based
2032	* (in absence of segment override prefixes)????
2033	*/
2034	#ifdef IN_RC
2035	LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
2036	#endif
2037	rc = PGMInvalidatePage(pVCpu, addr);
2038	if ( rc == VINF_SUCCESS
2039	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
2040	return VINF_SUCCESS;
2041	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
2042	("%Rrc addr=%RGv\n", VBOXSTRICTRC_VAL(rc), addr),
2043	VERR_EM_INTERPRETER);
2044	return rc;
2045	}
2046
2047	/** @todo change all these EMInterpretXXX methods to VBOXSTRICTRC. */
2048
2049	/**
2050	* Interpret CPUID given the parameters in the CPU context
2051	*
2052	* @returns VBox status code.
2053	* @param pVM Pointer to the VM.
2054	* @param pVCpu Pointer to the VMCPU.
2055	* @param pRegFrame The register frame.
2056	*
2057	*/
2058	VMMDECL(int) EMInterpretCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2059	{
2060	uint32_t iLeaf = pRegFrame->eax;
2061	NOREF(pVM);
2062
2063	/* cpuid clears the high dwords of the affected 64 bits registers. */
2064	pRegFrame->rax = 0;
2065	pRegFrame->rbx = 0;
2066	pRegFrame->rcx &= UINT64_C(0x00000000ffffffff);
2067	pRegFrame->rdx = 0;
2068
2069	/* Note: operates the same in 64 and non-64 bits mode. */
2070	CPUMGetGuestCpuId(pVCpu, iLeaf, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
2071	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
2072	return VINF_SUCCESS;
2073	}
2074
2075
2076	/**
2077	* CPUID Emulation.
2078	*/
2079	static int emInterpretCpuId(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2080	{
2081	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
2082	int rc = EMInterpretCpuId(pVM, pVCpu, pRegFrame);
2083	return rc;
2084	}
2085
2086
2087	/**
2088	* Interpret CRx read
2089	*
2090	* @returns VBox status code.
2091	* @param pVM Pointer to the VM.
2092	* @param pVCpu Pointer to the VMCPU.
2093	* @param pRegFrame The register frame.
2094	* @param DestRegGen General purpose register index (USE_REG_E**))
2095	* @param SrcRegCRx CRx register index (DISUSE_REG_CR*)
2096	*
2097	*/
2098	VMMDECL(int) EMInterpretCRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
2099	{
2100	uint64_t val64;
2101	int rc = CPUMGetGuestCRx(pVCpu, SrcRegCrx, &val64);
2102	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
2103	NOREF(pVM);
2104
2105	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2106	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2107	else
2108	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
2109
2110	if (RT_SUCCESS(rc))
2111	{
2112	LogFlow(("MOV_CR: gen32=%d CR=%d val=%RX64\n", DestRegGen, SrcRegCrx, val64));
2113	return VINF_SUCCESS;
2114	}
2115	return VERR_EM_INTERPRETER;
2116	}
2117
2118
2119
2120	/**
2121	* Interpret CLTS
2122	*
2123	* @returns VBox status code.
2124	* @param pVM Pointer to the VM.
2125	* @param pVCpu Pointer to the VMCPU.
2126	*
2127	*/
2128	VMMDECL(int) EMInterpretCLTS(PVM pVM, PVMCPU pVCpu)
2129	{
2130	NOREF(pVM);
2131	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2132	if (!(cr0 & X86_CR0_TS))
2133	return VINF_SUCCESS;
2134	return CPUMSetGuestCR0(pVCpu, cr0 & ~X86_CR0_TS);
2135	}
2136
2137	/**
2138	* CLTS Emulation.
2139	*/
2140	static int emInterpretClts(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2141	{
2142	NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
2143	return EMInterpretCLTS(pVM, pVCpu);
2144	}
2145
2146
2147	/**
2148	* Update CRx
2149	*
2150	* @returns VBox status code.
2151	* @param pVM Pointer to the VM.
2152	* @param pVCpu Pointer to the VMCPU.
2153	* @param pRegFrame The register frame.
2154	* @param DestRegCRx CRx register index (DISUSE_REG_CR*)
2155	* @param val New CRx value
2156	*
2157	*/
2158	static int emUpdateCRx(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint64_t val)
2159	{
2160	uint64_t oldval;
2161	uint64_t msrEFER;
2162	int rc, rc2;
2163	NOREF(pVM);
2164
2165	/** @todo Clean up this mess. */
2166	LogFlow(("EMInterpretCRxWrite at %RGv CR%d <- %RX64\n", (RTGCPTR)pRegFrame->rip, DestRegCrx, val));
2167	switch (DestRegCrx)
2168	{
2169	case DISCREG_CR0:
2170	oldval = CPUMGetGuestCR0(pVCpu);
2171	#ifdef IN_RC
2172	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
2173	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
2174	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
2175	return VERR_EM_INTERPRETER;
2176	#endif
2177	rc = VINF_SUCCESS;
2178	CPUMSetGuestCR0(pVCpu, val);
2179	val = CPUMGetGuestCR0(pVCpu);
2180	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
2181	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
2182	{
2183	/* global flush */
2184	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2185	AssertRCReturn(rc, rc);
2186	}
2187
2188	/* Deal with long mode enabling/disabling. */
2189	msrEFER = CPUMGetGuestEFER(pVCpu);
2190	if (msrEFER & MSR_K6_EFER_LME)
2191	{
2192	if ( !(oldval & X86_CR0_PG)
2193	&& (val & X86_CR0_PG))
2194	{
2195	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2196	if (pRegFrame->csHid.Attr.n.u1Long)
2197	{
2198	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
2199	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2200	}
2201
2202	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2203	if (!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PAE))
2204	{
2205	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
2206	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2207	}
2208	msrEFER \|= MSR_K6_EFER_LMA;
2209	}
2210	else
2211	if ( (oldval & X86_CR0_PG)
2212	&& !(val & X86_CR0_PG))
2213	{
2214	msrEFER &= ~MSR_K6_EFER_LMA;
2215	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
2216	}
2217	CPUMSetGuestEFER(pVCpu, msrEFER);
2218	}
2219	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2220	return rc2 == VINF_SUCCESS ? rc : rc2;
2221
2222	case DISCREG_CR2:
2223	rc = CPUMSetGuestCR2(pVCpu, val); AssertRC(rc);
2224	return VINF_SUCCESS;
2225
2226	case DISCREG_CR3:
2227	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
2228	rc = CPUMSetGuestCR3(pVCpu, val); AssertRC(rc);
2229	if (CPUMGetGuestCR0(pVCpu) & X86_CR0_PG)
2230	{
2231	/* flush */
2232	rc = PGMFlushTLB(pVCpu, val, !(CPUMGetGuestCR4(pVCpu) & X86_CR4_PGE));
2233	AssertRC(rc);
2234	}
2235	return rc;
2236
2237	case DISCREG_CR4:
2238	oldval = CPUMGetGuestCR4(pVCpu);
2239	rc = CPUMSetGuestCR4(pVCpu, val); AssertRC(rc);
2240	val = CPUMGetGuestCR4(pVCpu);
2241
2242	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2243	msrEFER = CPUMGetGuestEFER(pVCpu);
2244	if ( (msrEFER & MSR_K6_EFER_LMA)
2245	&& (oldval & X86_CR4_PAE)
2246	&& !(val & X86_CR4_PAE))
2247	{
2248	return VERR_EM_INTERPRETER; /** @todo generate #GP(0) */
2249	}
2250
2251	rc = VINF_SUCCESS;
2252	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
2253	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
2254	{
2255	/* global flush */
2256	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2257	AssertRCReturn(rc, rc);
2258	}
2259
2260	/* Feeling extremely lazy. */
2261	# ifdef IN_RC
2262	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
2263	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
2264	{
2265	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
2266	VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
2267	}
2268	# endif
2269	if ((val ^ oldval) & X86_CR4_VME)
2270	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
2271
2272	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2273	return rc2 == VINF_SUCCESS ? rc : rc2;
2274
2275	case DISCREG_CR8:
2276	return PDMApicSetTPR(pVCpu, val << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
2277
2278	default:
2279	AssertFailed();
2280	case DISCREG_CR1: /* illegal op */
2281	break;
2282	}
2283	return VERR_EM_INTERPRETER;
2284	}
2285
2286	/**
2287	* Interpret CRx write
2288	*
2289	* @returns VBox status code.
2290	* @param pVM Pointer to the VM.
2291	* @param pVCpu Pointer to the VMCPU.
2292	* @param pRegFrame The register frame.
2293	* @param DestRegCRx CRx register index (DISUSE_REG_CR*)
2294	* @param SrcRegGen General purpose register index (USE_REG_E**))
2295	*
2296	*/
2297	VMMDECL(int) EMInterpretCRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
2298	{
2299	uint64_t val;
2300	int rc;
2301
2302	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2303	{
2304	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2305	}
2306	else
2307	{
2308	uint32_t val32;
2309	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2310	val = val32;
2311	}
2312
2313	if (RT_SUCCESS(rc))
2314	return emUpdateCRx(pVM, pVCpu, pRegFrame, DestRegCrx, val);
2315
2316	return VERR_EM_INTERPRETER;
2317	}
2318
2319	/**
2320	* Interpret LMSW
2321	*
2322	* @returns VBox status code.
2323	* @param pVM Pointer to the VM.
2324	* @param pVCpu Pointer to the VMCPU.
2325	* @param pRegFrame The register frame.
2326	* @param u16Data LMSW source data.
2327	*
2328	*/
2329	VMMDECL(int) EMInterpretLMSW(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint16_t u16Data)
2330	{
2331	uint64_t OldCr0 = CPUMGetGuestCR0(pVCpu);
2332
2333	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
2334	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
2335	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
2336
2337	return emUpdateCRx(pVM, pVCpu, pRegFrame, DISCREG_CR0, NewCr0);
2338	}
2339
2340	/**
2341	* LMSW Emulation.
2342	*/
2343	static int emInterpretLmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2344	{
2345	DISQPVPARAMVAL param1;
2346	uint32_t val;
2347	NOREF(pvFault); NOREF(pcbSize);
2348
2349	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2350	if(RT_FAILURE(rc))
2351	return VERR_EM_INTERPRETER;
2352
2353	switch(param1.type)
2354	{
2355	case DISQPV_TYPE_IMMEDIATE:
2356	case DISQPV_TYPE_ADDRESS:
2357	if(!(param1.flags & DISQPV_FLAG_16))
2358	return VERR_EM_INTERPRETER;
2359	val = param1.val.val32;
2360	break;
2361
2362	default:
2363	return VERR_EM_INTERPRETER;
2364	}
2365
2366	LogFlow(("emInterpretLmsw %x\n", val));
2367	return EMInterpretLMSW(pVM, pVCpu, pRegFrame, val);
2368	}
2369
2370	#ifdef EM_EMULATE_SMSW
2371	/**
2372	* SMSW Emulation.
2373	*/
2374	static int emInterpretSmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2375	{
2376	DISQPVPARAMVAL param1;
2377	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2378
2379	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2380	if(RT_FAILURE(rc))
2381	return VERR_EM_INTERPRETER;
2382
2383	switch(param1.type)
2384	{
2385	case DISQPV_TYPE_IMMEDIATE:
2386	if(param1.size != sizeof(uint16_t))
2387	return VERR_EM_INTERPRETER;
2388	LogFlow(("emInterpretSmsw %d <- cr0 (%x)\n", pDis->Param1.Base.idxGenReg, cr0));
2389	rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, cr0);
2390	break;
2391
2392	case DISQPV_TYPE_ADDRESS:
2393	{
2394	RTGCPTR pParam1;
2395
2396	/* Actually forced to 16 bits regardless of the operand size. */
2397	if(param1.size != sizeof(uint16_t))
2398	return VERR_EM_INTERPRETER;
2399
2400	pParam1 = (RTGCPTR)param1.val.val64;
2401	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2402	LogFlow(("emInterpretSmsw %RGv <- cr0 (%x)\n", pParam1, cr0));
2403
2404	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &cr0, sizeof(uint16_t));
2405	if (RT_FAILURE(rc))
2406	{
2407	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2408	return VERR_EM_INTERPRETER;
2409	}
2410	break;
2411	}
2412
2413	default:
2414	return VERR_EM_INTERPRETER;
2415	}
2416
2417	LogFlow(("emInterpretSmsw %x\n", cr0));
2418	return rc;
2419	}
2420	#endif
2421
2422	/**
2423	* MOV CRx
2424	*/
2425	static int emInterpretMovCRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2426	{
2427	NOREF(pvFault); NOREF(pcbSize);
2428	if ((pDis->Param1.fUse == DISUSE_REG_GEN32 \|\| pDis->Param1.fUse == DISUSE_REG_GEN64) && pDis->Param2.fUse == DISUSE_REG_CR)
2429	return EMInterpretCRxRead(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxGenReg, pDis->Param2.Base.idxCtrlReg);
2430
2431	if (pDis->Param1.fUse == DISUSE_REG_CR && (pDis->Param2.fUse == DISUSE_REG_GEN32 \|\| pDis->Param2.fUse == DISUSE_REG_GEN64))
2432	return EMInterpretCRxWrite(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxCtrlReg, pDis->Param2.Base.idxGenReg);
2433
2434	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
2435	}
2436
2437
2438	/**
2439	* Interpret DRx write
2440	*
2441	* @returns VBox status code.
2442	* @param pVM Pointer to the VM.
2443	* @param pVCpu Pointer to the VMCPU.
2444	* @param pRegFrame The register frame.
2445	* @param DestRegDRx DRx register index (USE_REG_DR*)
2446	* @param SrcRegGen General purpose register index (USE_REG_E**))
2447	*
2448	*/
2449	VMMDECL(int) EMInterpretDRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
2450	{
2451	uint64_t val;
2452	int rc;
2453	NOREF(pVM);
2454
2455	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2456	{
2457	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2458	}
2459	else
2460	{
2461	uint32_t val32;
2462	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2463	val = val32;
2464	}
2465
2466	if (RT_SUCCESS(rc))
2467	{
2468	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
2469	rc = CPUMSetGuestDRx(pVCpu, DestRegDrx, val);
2470	if (RT_SUCCESS(rc))
2471	return rc;
2472	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
2473	}
2474	return VERR_EM_INTERPRETER;
2475	}
2476
2477
2478	/**
2479	* Interpret DRx read
2480	*
2481	* @returns VBox status code.
2482	* @param pVM Pointer to the VM.
2483	* @param pVCpu Pointer to the VMCPU.
2484	* @param pRegFrame The register frame.
2485	* @param DestRegGen General purpose register index (USE_REG_E**))
2486	* @param SrcRegDRx DRx register index (USE_REG_DR*)
2487	*
2488	*/
2489	VMMDECL(int) EMInterpretDRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
2490	{
2491	uint64_t val64;
2492	NOREF(pVM);
2493
2494	int rc = CPUMGetGuestDRx(pVCpu, SrcRegDrx, &val64);
2495	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
2496	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2497	{
2498	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2499	}
2500	else
2501	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
2502
2503	if (RT_SUCCESS(rc))
2504	return VINF_SUCCESS;
2505
2506	return VERR_EM_INTERPRETER;
2507	}
2508
2509
2510	/**
2511	* MOV DRx
2512	*/
2513	static int emInterpretMovDRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2514	{
2515	int rc = VERR_EM_INTERPRETER;
2516	NOREF(pvFault); NOREF(pcbSize);
2517
2518	if((pDis->Param1.fUse == DISUSE_REG_GEN32 \|\| pDis->Param1.fUse == DISUSE_REG_GEN64) && pDis->Param2.fUse == DISUSE_REG_DBG)
2519	{
2520	rc = EMInterpretDRxRead(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxGenReg, pDis->Param2.Base.idxDbgReg);
2521	}
2522	else
2523	if(pDis->Param1.fUse == DISUSE_REG_DBG && (pDis->Param2.fUse == DISUSE_REG_GEN32 \|\| pDis->Param2.fUse == DISUSE_REG_GEN64))
2524	{
2525	rc = EMInterpretDRxWrite(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxDbgReg, pDis->Param2.Base.idxGenReg);
2526	}
2527	else
2528	AssertMsgFailed(("Unexpected debug register move\n"));
2529
2530	return rc;
2531	}
2532
2533
2534	/**
2535	* LLDT Emulation.
2536	*/
2537	static int emInterpretLLdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2538	{
2539	DISQPVPARAMVAL param1;
2540	RTSEL sel;
2541	NOREF(pVM); NOREF(pvFault); NOREF(pcbSize);
2542
2543	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2544	if(RT_FAILURE(rc))
2545	return VERR_EM_INTERPRETER;
2546
2547	switch(param1.type)
2548	{
2549	case DISQPV_TYPE_ADDRESS:
2550	return VERR_EM_INTERPRETER; //feeling lazy right now
2551
2552	case DISQPV_TYPE_IMMEDIATE:
2553	if(!(param1.flags & DISQPV_FLAG_16))
2554	return VERR_EM_INTERPRETER;
2555	sel = (RTSEL)param1.val.val16;
2556	break;
2557
2558	default:
2559	return VERR_EM_INTERPRETER;
2560	}
2561
2562	#ifdef IN_RING0
2563	/* Only for the VT-x real-mode emulation case. */
2564	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2565	CPUMSetGuestLDTR(pVCpu, sel);
2566	return VINF_SUCCESS;
2567	#else
2568	if (sel == 0)
2569	{
2570	if (CPUMGetHyperLDTR(pVCpu) == 0)
2571	{
2572	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
2573	return VINF_SUCCESS;
2574	}
2575	}
2576	//still feeling lazy
2577	return VERR_EM_INTERPRETER;
2578	#endif
2579	}
2580
2581	#ifdef IN_RING0
2582	/**
2583	* LIDT/LGDT Emulation.
2584	*/
2585	static int emInterpretLIGdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2586	{
2587	DISQPVPARAMVAL param1;
2588	RTGCPTR pParam1;
2589	X86XDTR32 dtr32;
2590	NOREF(pvFault); NOREF(pcbSize);
2591
2592	Log(("Emulate %s at %RGv\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip));
2593
2594	/* Only for the VT-x real-mode emulation case. */
2595	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2596
2597	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2598	if(RT_FAILURE(rc))
2599	return VERR_EM_INTERPRETER;
2600
2601	switch(param1.type)
2602	{
2603	case DISQPV_TYPE_ADDRESS:
2604	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, param1.val.val16);
2605	break;
2606
2607	default:
2608	return VERR_EM_INTERPRETER;
2609	}
2610
2611	rc = emRamRead(pVM, pVCpu, pRegFrame, &dtr32, pParam1, sizeof(dtr32));
2612	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2613
2614	if (!(pDis->fPrefix & DISPREFIX_OPSIZE))
2615	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
2616
2617	if (pDis->pCurInstr->uOpcode == OP_LIDT)
2618	CPUMSetGuestIDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2619	else
2620	CPUMSetGuestGDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2621
2622	return VINF_SUCCESS;
2623	}
2624	#endif
2625
2626
2627	#ifdef IN_RC
2628	/**
2629	* STI Emulation.
2630	*
2631	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
2632	*/
2633	static int emInterpretSti(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2634	{
2635	NOREF(pcbSize);
2636	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
2637
2638	if(!pGCState)
2639	{
2640	Assert(pGCState);
2641	return VERR_EM_INTERPRETER;
2642	}
2643	pGCState->uVMFlags \|= X86_EFL_IF;
2644
2645	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
2646	Assert(pvFault == SELMToFlat(pVM, DISSELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
2647
2648	pVCpu->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pDis->cbInstr;
2649	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2650
2651	return VINF_SUCCESS;
2652	}
2653	#endif /* IN_RC */
2654
2655
2656	/**
2657	* HLT Emulation.
2658	*/
2659	static VBOXSTRICTRC
2660	emInterpretHlt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2661	{
2662	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
2663	return VINF_EM_HALT;
2664	}
2665
2666
2667	/**
2668	* Interpret RDTSC
2669	*
2670	* @returns VBox status code.
2671	* @param pVM Pointer to the VM.
2672	* @param pVCpu Pointer to the VMCPU.
2673	* @param pRegFrame The register frame.
2674	*
2675	*/
2676	VMMDECL(int) EMInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2677	{
2678	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2679
2680	if (uCR4 & X86_CR4_TSD)
2681	return VERR_EM_INTERPRETER; /* genuine #GP */
2682
2683	uint64_t uTicks = TMCpuTickGet(pVCpu);
2684
2685	/* Same behaviour in 32 & 64 bits mode */
2686	pRegFrame->rax = (uint32_t)uTicks;
2687	pRegFrame->rdx = (uTicks >> 32ULL);
2688
2689	NOREF(pVM);
2690	return VINF_SUCCESS;
2691	}
2692
2693	/**
2694	* Interpret RDTSCP
2695	*
2696	* @returns VBox status code.
2697	* @param pVM Pointer to the VM.
2698	* @param pVCpu Pointer to the VMCPU.
2699	* @param pCtx The CPU context.
2700	*
2701	*/
2702	VMMDECL(int) EMInterpretRdtscp(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2703	{
2704	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2705
2706	if (!CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
2707	{
2708	AssertFailed();
2709	return VERR_EM_INTERPRETER; /* genuine #UD */
2710	}
2711
2712	if (uCR4 & X86_CR4_TSD)
2713	return VERR_EM_INTERPRETER; /* genuine #GP */
2714
2715	uint64_t uTicks = TMCpuTickGet(pVCpu);
2716
2717	/* Same behaviour in 32 & 64 bits mode */
2718	pCtx->rax = (uint32_t)uTicks;
2719	pCtx->rdx = (uTicks >> 32ULL);
2720	/* Low dword of the TSC_AUX msr only. */
2721	CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pCtx->rcx);
2722	pCtx->rcx &= UINT32_C(0xffffffff);
2723
2724	return VINF_SUCCESS;
2725	}
2726
2727	/**
2728	* RDTSC Emulation.
2729	*/
2730	static int emInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2731	{
2732	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
2733	return EMInterpretRdtsc(pVM, pVCpu, pRegFrame);
2734	}
2735
2736	/**
2737	* Interpret RDPMC
2738	*
2739	* @returns VBox status code.
2740	* @param pVM Pointer to the VM.
2741	* @param pVCpu Pointer to the VMCPU.
2742	* @param pRegFrame The register frame.
2743	*
2744	*/
2745	VMMDECL(int) EMInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2746	{
2747	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2748
2749	/* If X86_CR4_PCE is not set, then CPL must be zero. */
2750	if ( !(uCR4 & X86_CR4_PCE)
2751	&& CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
2752	{
2753	Assert(CPUMGetGuestCR0(pVCpu) & X86_CR0_PE);
2754	return VERR_EM_INTERPRETER; /* genuine #GP */
2755	}
2756
2757	/* Just return zero here; rather tricky to properly emulate this, especially as the specs are a mess. */
2758	pRegFrame->rax = 0;
2759	pRegFrame->rdx = 0;
2760	/** @todo We should trigger a #GP here if the cpu doesn't support the index in ecx. */
2761
2762	NOREF(pVM);
2763	return VINF_SUCCESS;
2764	}
2765
2766	/**
2767	* RDPMC Emulation
2768	*/
2769	static int emInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2770	{
2771	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
2772	return EMInterpretRdpmc(pVM, pVCpu, pRegFrame);
2773	}
2774
2775
2776	/**
2777	* MONITOR Emulation.
2778	*/
2779	VMMDECL(int) EMInterpretMonitor(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2780	{
2781	uint32_t u32Dummy, u32ExtFeatures, cpl;
2782	NOREF(pVM);
2783
2784	if (pRegFrame->ecx != 0)
2785	{
2786	Log(("emInterpretMonitor: unexpected ecx=%x -> recompiler!!\n", pRegFrame->ecx));
2787	return VERR_EM_INTERPRETER; /* illegal value. */
2788	}
2789
2790	/* Get the current privilege level. */
2791	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2792	if (cpl != 0)
2793	return VERR_EM_INTERPRETER; /* supervisor only */
2794
2795	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2796	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2797	return VERR_EM_INTERPRETER; /* not supported */
2798
2799	EMMonitorWaitPrepare(pVCpu, pRegFrame->rax, pRegFrame->rcx, pRegFrame->rdx);
2800	return VINF_SUCCESS;
2801	}
2802
2803	static int emInterpretMonitor(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2804	{
2805	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
2806	return EMInterpretMonitor(pVM, pVCpu, pRegFrame);
2807	}
2808
2809
2810	/**
2811	* MWAIT Emulation.
2812	*/
2813	VMMDECL(VBOXSTRICTRC) EMInterpretMWait(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2814	{
2815	uint32_t u32Dummy, u32ExtFeatures, cpl, u32MWaitFeatures;
2816	NOREF(pVM);
2817
2818	/* Get the current privilege level. */
2819	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2820	if (cpl != 0)
2821	return VERR_EM_INTERPRETER; /* supervisor only */
2822
2823	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2824	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2825	return VERR_EM_INTERPRETER; /* not supported */
2826
2827	/*
2828	* CPUID.05H.ECX[0] defines support for power management extensions (eax)
2829	* CPUID.05H.ECX[1] defines support for interrupts as break events for mwait even when IF=0
2830	*/
2831	CPUMGetGuestCpuId(pVCpu, 5, &u32Dummy, &u32Dummy, &u32MWaitFeatures, &u32Dummy);
2832	if (pRegFrame->ecx > 1)
2833	{
2834	Log(("EMInterpretMWait: unexpected ecx value %x -> recompiler\n", pRegFrame->ecx));
2835	return VERR_EM_INTERPRETER; /* illegal value. */
2836	}
2837
2838	if (pRegFrame->ecx && !(u32MWaitFeatures & X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
2839	{
2840	Log(("EMInterpretMWait: unsupported X86_CPUID_MWAIT_ECX_BREAKIRQIF0 -> recompiler\n"));
2841	return VERR_EM_INTERPRETER; /* illegal value. */
2842	}
2843
2844	return EMMonitorWaitPerform(pVCpu, pRegFrame->rax, pRegFrame->rcx);
2845	}
2846
2847	static VBOXSTRICTRC emInterpretMWait(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2848	{
2849	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
2850	return EMInterpretMWait(pVM, pVCpu, pRegFrame);
2851	}
2852
2853
2854	#ifdef LOG_ENABLED
2855	static const char *emMSRtoString(uint32_t uMsr)
2856	{
2857	switch (uMsr)
2858	{
2859	case MSR_IA32_APICBASE:
2860	return "MSR_IA32_APICBASE";
2861	case MSR_IA32_CR_PAT:
2862	return "MSR_IA32_CR_PAT";
2863	case MSR_IA32_SYSENTER_CS:
2864	return "MSR_IA32_SYSENTER_CS";
2865	case MSR_IA32_SYSENTER_EIP:
2866	return "MSR_IA32_SYSENTER_EIP";
2867	case MSR_IA32_SYSENTER_ESP:
2868	return "MSR_IA32_SYSENTER_ESP";
2869	case MSR_K6_EFER:
2870	return "MSR_K6_EFER";
2871	case MSR_K8_SF_MASK:
2872	return "MSR_K8_SF_MASK";
2873	case MSR_K6_STAR:
2874	return "MSR_K6_STAR";
2875	case MSR_K8_LSTAR:
2876	return "MSR_K8_LSTAR";
2877	case MSR_K8_CSTAR:
2878	return "MSR_K8_CSTAR";
2879	case MSR_K8_FS_BASE:
2880	return "MSR_K8_FS_BASE";
2881	case MSR_K8_GS_BASE:
2882	return "MSR_K8_GS_BASE";
2883	case MSR_K8_KERNEL_GS_BASE:
2884	return "MSR_K8_KERNEL_GS_BASE";
2885	case MSR_K8_TSC_AUX:
2886	return "MSR_K8_TSC_AUX";
2887	case MSR_IA32_BIOS_SIGN_ID:
2888	return "Unsupported MSR_IA32_BIOS_SIGN_ID";
2889	case MSR_IA32_PLATFORM_ID:
2890	return "Unsupported MSR_IA32_PLATFORM_ID";
2891	case MSR_IA32_BIOS_UPDT_TRIG:
2892	return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
2893	case MSR_IA32_TSC:
2894	return "MSR_IA32_TSC";
2895	case MSR_IA32_MISC_ENABLE:
2896	return "MSR_IA32_MISC_ENABLE";
2897	case MSR_IA32_MTRR_CAP:
2898	return "MSR_IA32_MTRR_CAP";
2899	case MSR_IA32_MCP_CAP:
2900	return "Unsupported MSR_IA32_MCP_CAP";
2901	case MSR_IA32_MCP_STATUS:
2902	return "Unsupported MSR_IA32_MCP_STATUS";
2903	case MSR_IA32_MCP_CTRL:
2904	return "Unsupported MSR_IA32_MCP_CTRL";
2905	case MSR_IA32_MTRR_DEF_TYPE:
2906	return "MSR_IA32_MTRR_DEF_TYPE";
2907	case MSR_K7_EVNTSEL0:
2908	return "Unsupported MSR_K7_EVNTSEL0";
2909	case MSR_K7_EVNTSEL1:
2910	return "Unsupported MSR_K7_EVNTSEL1";
2911	case MSR_K7_EVNTSEL2:
2912	return "Unsupported MSR_K7_EVNTSEL2";
2913	case MSR_K7_EVNTSEL3:
2914	return "Unsupported MSR_K7_EVNTSEL3";
2915	case MSR_IA32_MC0_CTL:
2916	return "Unsupported MSR_IA32_MC0_CTL";
2917	case MSR_IA32_MC0_STATUS:
2918	return "Unsupported MSR_IA32_MC0_STATUS";
2919	case MSR_IA32_PERFEVTSEL0:
2920	return "Unsupported MSR_IA32_PERFEVTSEL0";
2921	case MSR_IA32_PERFEVTSEL1:
2922	return "Unsupported MSR_IA32_PERFEVTSEL1";
2923	case MSR_IA32_PERF_STATUS:
2924	return "MSR_IA32_PERF_STATUS";
2925	case MSR_IA32_PLATFORM_INFO:
2926	return "MSR_IA32_PLATFORM_INFO";
2927	case MSR_IA32_PERF_CTL:
2928	return "Unsupported MSR_IA32_PERF_CTL";
2929	case MSR_K7_PERFCTR0:
2930	return "Unsupported MSR_K7_PERFCTR0";
2931	case MSR_K7_PERFCTR1:
2932	return "Unsupported MSR_K7_PERFCTR1";
2933	case MSR_K7_PERFCTR2:
2934	return "Unsupported MSR_K7_PERFCTR2";
2935	case MSR_K7_PERFCTR3:
2936	return "Unsupported MSR_K7_PERFCTR3";
2937	case MSR_IA32_PMC0:
2938	return "Unsupported MSR_IA32_PMC0";
2939	case MSR_IA32_PMC1:
2940	return "Unsupported MSR_IA32_PMC1";
2941	case MSR_IA32_PMC2:
2942	return "Unsupported MSR_IA32_PMC2";
2943	case MSR_IA32_PMC3:
2944	return "Unsupported MSR_IA32_PMC3";
2945	}
2946	return "Unknown MSR";
2947	}
2948	#endif /* LOG_ENABLED */
2949
2950
2951	/**
2952	* Interpret RDMSR
2953	*
2954	* @returns VBox status code.
2955	* @param pVM Pointer to the VM.
2956	* @param pVCpu Pointer to the VMCPU.
2957	* @param pRegFrame The register frame.
2958	*/
2959	VMMDECL(int) EMInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2960	{
2961	/** @todo According to the Intel manuals, there's a REX version of RDMSR that is slightly different.
2962	* That version clears the high dwords of both RDX & RAX */
2963	NOREF(pVM);
2964
2965	/* Get the current privilege level. */
2966	if (CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
2967	return VERR_EM_INTERPRETER; /* supervisor only */
2968
2969	uint64_t uValue;
2970	int rc = CPUMQueryGuestMsr(pVCpu, pRegFrame->ecx, &uValue);
2971	if (RT_UNLIKELY(rc != VINF_SUCCESS))
2972	{
2973	Assert(rc == VERR_CPUM_RAISE_GP_0);
2974	return VERR_EM_INTERPRETER;
2975	}
2976	pRegFrame->rax = (uint32_t) uValue;
2977	pRegFrame->rdx = (uint32_t)(uValue >> 32);
2978	LogFlow(("EMInterpretRdmsr %s (%x) -> %RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, uValue));
2979	return rc;
2980	}
2981
2982
2983	/**
2984	* RDMSR Emulation.
2985	*/
2986	static int emInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2987	{
2988	/* Note: The Intel manual claims there's a REX version of RDMSR that's slightly
2989	different, so we play safe by completely disassembling the instruction. */
2990	Assert(!(pDis->fPrefix & DISPREFIX_REX));
2991	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
2992	return EMInterpretRdmsr(pVM, pVCpu, pRegFrame);
2993	}
2994
2995
2996	/**
2997	* Interpret WRMSR
2998	*
2999	* @returns VBox status code.
3000	* @param pVM Pointer to the VM.
3001	* @param pVCpu Pointer to the VMCPU.
3002	* @param pRegFrame The register frame.
3003	*/
3004	VMMDECL(int) EMInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
3005	{
3006	/* Check the current privilege level, this instruction is supervisor only. */
3007	if (CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
3008	return VERR_EM_INTERPRETER; /** @todo raise \#GP(0) */
3009
3010	int rc = CPUMSetGuestMsr(pVCpu, pRegFrame->ecx, RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx));
3011	if (rc != VINF_SUCCESS)
3012	{
3013	Assert(rc == VERR_CPUM_RAISE_GP_0);
3014	return VERR_EM_INTERPRETER;
3015	}
3016	LogFlow(("EMInterpretWrmsr %s (%x) val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx,
3017	RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx)));
3018	NOREF(pVM);
3019	return rc;
3020	}
3021
3022
3023	/**
3024	* WRMSR Emulation.
3025	*/
3026	static int emInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3027	{
3028	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3029	return EMInterpretWrmsr(pVM, pVCpu, pRegFrame);
3030	}
3031
3032
3033	/**
3034	* Internal worker.
3035	* @copydoc emInterpretInstructionCPUOuter
3036	*/
3037	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
3038	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize)
3039	{
3040	Assert(enmCodeType == EMCODETYPE_SUPERVISOR \|\| enmCodeType == EMCODETYPE_ALL);
3041	Assert(pcbSize);
3042	*pcbSize = 0;
3043
3044	if (enmCodeType == EMCODETYPE_SUPERVISOR)
3045	{
3046	/*
3047	* Only supervisor guest code!!
3048	* And no complicated prefixes.
3049	*/
3050	/* Get the current privilege level. */
3051	uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
3052	if ( cpl != 0
3053	&& pDis->pCurInstr->uOpcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
3054	{
3055	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
3056	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
3057	return VERR_EM_INTERPRETER;
3058	}
3059	}
3060	else
3061	Log2(("emInterpretInstructionCPU allowed to interpret user-level code!!\n"));
3062
3063	#ifdef IN_RC
3064	if ( (pDis->fPrefix & (DISPREFIX_REPNE \| DISPREFIX_REP))
3065	\|\| ( (pDis->fPrefix & DISPREFIX_LOCK)
3066	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG
3067	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG8B
3068	&& pDis->pCurInstr->uOpcode != OP_XADD
3069	&& pDis->pCurInstr->uOpcode != OP_OR
3070	&& pDis->pCurInstr->uOpcode != OP_AND
3071	&& pDis->pCurInstr->uOpcode != OP_XOR
3072	&& pDis->pCurInstr->uOpcode != OP_BTR
3073	)
3074	)
3075	#else
3076	if ( (pDis->fPrefix & DISPREFIX_REPNE)
3077	\|\| ( (pDis->fPrefix & DISPREFIX_REP)
3078	&& pDis->pCurInstr->uOpcode != OP_STOSWD
3079	)
3080	\|\| ( (pDis->fPrefix & DISPREFIX_LOCK)
3081	&& pDis->pCurInstr->uOpcode != OP_OR
3082	&& pDis->pCurInstr->uOpcode != OP_AND
3083	&& pDis->pCurInstr->uOpcode != OP_XOR
3084	&& pDis->pCurInstr->uOpcode != OP_BTR
3085	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG
3086	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG8B
3087	)
3088	)
3089	#endif
3090	{
3091	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
3092	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
3093	return VERR_EM_INTERPRETER;
3094	}
3095
3096	#if HC_ARCH_BITS == 32
3097	/*
3098	* Unable to emulate most >4 bytes accesses in 32 bits mode.
3099	* Whitelisted instructions are safe.
3100	*/
3101	if ( pDis->Param1.cb > 4
3102	&& CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
3103	{
3104	uint32_t uOpCode = pDis->pCurInstr->uOpcode;
3105	if ( uOpCode != OP_STOSWD
3106	&& uOpCode != OP_MOV
3107	&& uOpCode != OP_CMPXCHG8B
3108	&& uOpCode != OP_XCHG
3109	&& uOpCode != OP_BTS
3110	&& uOpCode != OP_BTR
3111	&& uOpCode != OP_BTC
3112	# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0
3113	&& uOpCode != OP_CMPXCHG /* solaris */
3114	&& uOpCode != OP_AND /* windows */
3115	&& uOpCode != OP_OR /* windows */
3116	&& uOpCode != OP_XOR /* because we can */
3117	&& uOpCode != OP_ADD /* windows (dripple) */
3118	&& uOpCode != OP_ADC /* because we can */
3119	&& uOpCode != OP_SUB /* because we can */
3120	/** @todo OP_BTS or is that a different kind of failure? */
3121	# endif
3122	)
3123	{
3124	# ifdef VBOX_WITH_STATISTICS
3125	switch (pDis->pCurInstr->uOpcode)
3126	{
3127	# define INTERPRET_FAILED_CASE(opcode, Instr) \
3128	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); break;
3129	INTERPRET_FAILED_CASE(OP_XCHG,Xchg);
3130	INTERPRET_FAILED_CASE(OP_DEC,Dec);
3131	INTERPRET_FAILED_CASE(OP_INC,Inc);
3132	INTERPRET_FAILED_CASE(OP_POP,Pop);
3133	INTERPRET_FAILED_CASE(OP_OR, Or);
3134	INTERPRET_FAILED_CASE(OP_XOR,Xor);
3135	INTERPRET_FAILED_CASE(OP_AND,And);
3136	INTERPRET_FAILED_CASE(OP_MOV,Mov);
3137	INTERPRET_FAILED_CASE(OP_STOSWD,StosWD);
3138	INTERPRET_FAILED_CASE(OP_INVLPG,InvlPg);
3139	INTERPRET_FAILED_CASE(OP_CPUID,CpuId);
3140	INTERPRET_FAILED_CASE(OP_MOV_CR,MovCRx);
3141	INTERPRET_FAILED_CASE(OP_MOV_DR,MovDRx);
3142	INTERPRET_FAILED_CASE(OP_LLDT,LLdt);
3143	INTERPRET_FAILED_CASE(OP_LIDT,LIdt);
3144	INTERPRET_FAILED_CASE(OP_LGDT,LGdt);
3145	INTERPRET_FAILED_CASE(OP_LMSW,Lmsw);
3146	INTERPRET_FAILED_CASE(OP_CLTS,Clts);
3147	INTERPRET_FAILED_CASE(OP_MONITOR,Monitor);
3148	INTERPRET_FAILED_CASE(OP_MWAIT,MWait);
3149	INTERPRET_FAILED_CASE(OP_RDMSR,Rdmsr);
3150	INTERPRET_FAILED_CASE(OP_WRMSR,Wrmsr);
3151	INTERPRET_FAILED_CASE(OP_ADD,Add);
3152	INTERPRET_FAILED_CASE(OP_SUB,Sub);
3153	INTERPRET_FAILED_CASE(OP_ADC,Adc);
3154	INTERPRET_FAILED_CASE(OP_BTR,Btr);
3155	INTERPRET_FAILED_CASE(OP_BTS,Bts);
3156	INTERPRET_FAILED_CASE(OP_BTC,Btc);
3157	INTERPRET_FAILED_CASE(OP_RDTSC,Rdtsc);
3158	INTERPRET_FAILED_CASE(OP_CMPXCHG, CmpXchg);
3159	INTERPRET_FAILED_CASE(OP_STI, Sti);
3160	INTERPRET_FAILED_CASE(OP_XADD,XAdd);
3161	INTERPRET_FAILED_CASE(OP_CMPXCHG8B,CmpXchg8b);
3162	INTERPRET_FAILED_CASE(OP_HLT, Hlt);
3163	INTERPRET_FAILED_CASE(OP_IRET,Iret);
3164	INTERPRET_FAILED_CASE(OP_WBINVD,WbInvd);
3165	INTERPRET_FAILED_CASE(OP_MOVNTPS,MovNTPS);
3166	# undef INTERPRET_FAILED_CASE
3167	default:
3168	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3169	break;
3170	}
3171	# endif /* VBOX_WITH_STATISTICS */
3172	return VERR_EM_INTERPRETER;
3173	}
3174	}
3175	#endif
3176
3177	VBOXSTRICTRC rc;
3178	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
3179	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pDis)));
3180	#endif
3181	switch (pDis->pCurInstr->uOpcode)
3182	{
3183	/*
3184	* Macros for generating the right case statements.
3185	*/
3186	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3187	case opcode:\
3188	if (pDis->fPrefix & DISPREFIX_LOCK) \
3189	rc = emInterpretLock##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
3190	else \
3191	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3192	if (RT_SUCCESS(rc)) \
3193	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3194	else \
3195	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3196	return rc
3197	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
3198	case opcode:\
3199	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3200	if (RT_SUCCESS(rc)) \
3201	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3202	else \
3203	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3204	return rc
3205
3206	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
3207	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
3208	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3209	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
3210
3211	#define INTERPRET_CASE(opcode, Instr) \
3212	case opcode:\
3213	rc = emInterpret##Instr(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3214	if (RT_SUCCESS(rc)) \
3215	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3216	else \
3217	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3218	return rc
3219
3220	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
3221	case opcode:\
3222	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3223	if (RT_SUCCESS(rc)) \
3224	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3225	else \
3226	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3227	return rc
3228
3229	#define INTERPRET_STAT_CASE(opcode, Instr) \
3230	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
3231
3232	/*
3233	* The actual case statements.
3234	*/
3235	INTERPRET_CASE(OP_XCHG,Xchg);
3236	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
3237	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
3238	INTERPRET_CASE(OP_POP,Pop);
3239	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
3240	INTERPRET_CASE_EX_LOCK_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor, EMEmulateLockXor);
3241	INTERPRET_CASE_EX_LOCK_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd, EMEmulateLockAnd);
3242	INTERPRET_CASE(OP_MOV,Mov);
3243	#ifndef IN_RC
3244	INTERPRET_CASE(OP_STOSWD,StosWD);
3245	#endif
3246	INTERPRET_CASE(OP_INVLPG,InvlPg);
3247	INTERPRET_CASE(OP_CPUID,CpuId);
3248	INTERPRET_CASE(OP_MOV_CR,MovCRx);
3249	INTERPRET_CASE(OP_MOV_DR,MovDRx);
3250	#ifdef IN_RING0
3251	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
3252	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
3253	#endif
3254	INTERPRET_CASE(OP_LLDT,LLdt);
3255	INTERPRET_CASE(OP_LMSW,Lmsw);
3256	#ifdef EM_EMULATE_SMSW
3257	INTERPRET_CASE(OP_SMSW,Smsw);
3258	#endif
3259	INTERPRET_CASE(OP_CLTS,Clts);
3260	INTERPRET_CASE(OP_MONITOR, Monitor);
3261	INTERPRET_CASE(OP_MWAIT, MWait);
3262	INTERPRET_CASE(OP_RDMSR, Rdmsr);
3263	INTERPRET_CASE(OP_WRMSR, Wrmsr);
3264	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
3265	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
3266	INTERPRET_CASE(OP_ADC,Adc);
3267	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
3268	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
3269	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
3270	INTERPRET_CASE(OP_RDPMC,Rdpmc);
3271	INTERPRET_CASE(OP_RDTSC,Rdtsc);
3272	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
3273	#ifdef IN_RC
3274	INTERPRET_CASE(OP_STI,Sti);
3275	INTERPRET_CASE(OP_XADD, XAdd);
3276	#endif
3277	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
3278	INTERPRET_CASE(OP_HLT,Hlt);
3279	INTERPRET_CASE(OP_IRET,Iret);
3280	INTERPRET_CASE(OP_WBINVD,WbInvd);
3281	#ifdef VBOX_WITH_STATISTICS
3282	# ifndef IN_RC
3283	INTERPRET_STAT_CASE(OP_XADD, XAdd);
3284	# endif
3285	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
3286	#endif
3287
3288	default:
3289	Log3(("emInterpretInstructionCPU: opcode=%d\n", pDis->pCurInstr->uOpcode));
3290	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3291	return VERR_EM_INTERPRETER;
3292
3293	#undef INTERPRET_CASE_EX_PARAM2
3294	#undef INTERPRET_STAT_CASE
3295	#undef INTERPRET_CASE_EX
3296	#undef INTERPRET_CASE
3297	} /* switch (opcode) */
3298	/* not reached */
3299	}
3300
3301	/**
3302	* Interprets the current instruction using the supplied DISCPUSTATE structure.
3303	*
3304	* EIP is NOT updated!
3305	*
3306	* @returns VBox strict status code.
3307	* @retval VINF_* Scheduling instructions. When these are returned, it
3308	* starts to get a bit tricky to know whether code was
3309	* executed or not... We'll address this when it becomes a problem.
3310	* @retval VERR_EM_INTERPRETER Something we can't cope with.
3311	* @retval VERR_* Fatal errors.
3312	*
3313	* @param pVCpu Pointer to the VMCPU.
3314	* @param pDis The disassembler cpu state for the instruction to be
3315	* interpreted.
3316	* @param pRegFrame The register frame. EIP is NOT changed!
3317	* @param pvFault The fault address (CR2).
3318	* @param pcbSize Size of the write (if applicable).
3319	* @param enmCodeType Code type (user/supervisor)
3320	*
3321	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
3322	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
3323	* to worry about e.g. invalid modrm combinations (!)
3324	*
3325	* @todo At this time we do NOT check if the instruction overwrites vital information.
3326	* Make sure this can't happen!! (will add some assertions/checks later)
3327	*/
3328	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPUOuter(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
3329	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize)
3330	{
3331	STAM_PROFILE_START(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
3332	VBOXSTRICTRC rc = emInterpretInstructionCPU(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, pRegFrame, pvFault, enmCodeType, pcbSize);
3333	STAM_PROFILE_STOP(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
3334	if (RT_SUCCESS(rc))
3335	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
3336	else
3337	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
3338	return rc;
3339	}
3340
3341
3342	#endif /* !VBOX_WITH_IEM */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 41823

Download in other formats: